Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 08:57

General

  • Target

    JaffaCakes118_689ef0f2e6af8ad3d32ab57e1b21a5ee.exe

  • Size

    1.4MB

  • MD5

    689ef0f2e6af8ad3d32ab57e1b21a5ee

  • SHA1

    3dd4725886252418e31e12ab069e73b12d6503b3

  • SHA256

    52a7d48f7b130539b1f1c97736170ced7b48fe38473656a7d32405a9ca20a586

  • SHA512

    c0695108cc48873f59aa149328320324f0d3ac208910465a57ef177173a0d6fc73cf62b0ebdc8f51c355134f09d7445328412d22ee6bb8c1490ad641bdd6bba2

  • SSDEEP

    24576:2QuC55ocNjUen9Orr/dJN8DIo6YqJWVzlF2jXAo9ImxkSe8dZYZn3a9J4Ws/HIvZ:2zC5KcNjUg9ijN8Dv6TJWxlskfm7e8dn

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Modifies Windows Firewall 2 TTPs 24 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 6 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:804
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:316
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:1112
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3100
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3128
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3448
                  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689ef0f2e6af8ad3d32ab57e1b21a5ee.exe
                    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689ef0f2e6af8ad3d32ab57e1b21a5ee.exe"
                    2⤵
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Loads dropped DLL
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2996
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall set opmode disable
                      3⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4880
                    • C:\Windows\SysWOW64\explorer.exe
                      explorer C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_689ef0f2e6af8ad3d32ab57e1b21a5ee
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4452
                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                      C:\Windows\system32\B526A5\DECB07.EXE
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:5048
                      • C:\Windows\SysWOW64\explorer.exe
                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                        4⤵
                          PID:4528
                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                          C:\Windows\system32\B526A5\DECB07.EXE
                          4⤵
                            PID:400
                            • C:\Windows\SysWOW64\explorer.exe
                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                              5⤵
                                PID:3612
                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                C:\Windows\system32\B526A5\DECB07.EXE
                                5⤵
                                  PID:1984
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh firewall set opmode disable
                                    6⤵
                                    • Modifies Windows Firewall
                                    PID:1836
                                  • C:\Windows\SysWOW64\explorer.exe
                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                    6⤵
                                      PID:2172
                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                      C:\Windows\system32\B526A5\DECB07.EXE
                                      6⤵
                                        PID:3600
                                        • C:\Windows\SysWOW64\explorer.exe
                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                          7⤵
                                            PID:3640
                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                            C:\Windows\system32\B526A5\DECB07.EXE
                                            7⤵
                                              PID:1240
                                              • C:\Windows\SysWOW64\explorer.exe
                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                8⤵
                                                  PID:2196
                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                  8⤵
                                                    PID:3444
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh firewall set opmode disable
                                                      9⤵
                                                      • Modifies Windows Firewall
                                                      PID:3084
                                                    • C:\Windows\SysWOW64\explorer.exe
                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                      9⤵
                                                        PID:4536
                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                        9⤵
                                                          PID:452
                                                          • C:\Windows\SysWOW64\explorer.exe
                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                            10⤵
                                                              PID:3584
                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                              10⤵
                                                                PID:2716
                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                  11⤵
                                                                    PID:2764
                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                    11⤵
                                                                      PID:4944
                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                        12⤵
                                                                          PID:1556
                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                          12⤵
                                                                            PID:4356
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh firewall set opmode disable
                                                                              13⤵
                                                                              • Modifies Windows Firewall
                                                                              PID:3268
                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                              13⤵
                                                                                PID:456
                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                13⤵
                                                                                  PID:2300
                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                    14⤵
                                                                                      PID:1416
                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                      14⤵
                                                                                        PID:1712
                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                          15⤵
                                                                                            PID:1756
                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                            15⤵
                                                                                              PID:3444
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall set opmode disable
                                                                                                16⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:3176
                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                16⤵
                                                                                                  PID:2072
                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                  16⤵
                                                                                                    PID:4244
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                      17⤵
                                                                                                        PID:1944
                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                        17⤵
                                                                                                          PID:4496
                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                            18⤵
                                                                                                              PID:1864
                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                              18⤵
                                                                                                                PID:3212
                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                  netsh firewall set opmode disable
                                                                                                                  19⤵
                                                                                                                  • Modifies Windows Firewall
                                                                                                                  PID:2912
                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                  19⤵
                                                                                                                    PID:3864
                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                    19⤵
                                                                                                                      PID:2196
                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                        20⤵
                                                                                                                          PID:3084
                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                          20⤵
                                                                                                                            PID:4324
                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                              21⤵
                                                                                                                                PID:2360
                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                21⤵
                                                                                                                                  PID:1812
                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                    netsh firewall set opmode disable
                                                                                                                                    22⤵
                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                    PID:4944
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 84
                                                                                                                                      23⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:1988
                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                    22⤵
                                                                                                                                      PID:4076
                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                      22⤵
                                                                                                                                        PID:64
                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                          23⤵
                                                                                                                                            PID:560
                                                                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                            23⤵
                                                                                                                                              PID:116
                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                netsh firewall set opmode disable
                                                                                                                                                24⤵
                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                PID:3036
                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                24⤵
                                                                                                                                                  PID:5224
                                                                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                  24⤵
                                                                                                                                                    PID:5304
                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                      25⤵
                                                                                                                                                        PID:5488
                                                                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                        25⤵
                                                                                                                                                          PID:5552
                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                            26⤵
                                                                                                                                                              PID:5724
                                                                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                              26⤵
                                                                                                                                                                PID:5852
                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                  netsh firewall set opmode disable
                                                                                                                                                                  27⤵
                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                  PID:5956
                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                  27⤵
                                                                                                                                                                    PID:3968
                                                                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                    27⤵
                                                                                                                                                                      PID:3600
                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                        28⤵
                                                                                                                                                                          PID:5764
                                                                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                          28⤵
                                                                                                                                                                            PID:1936
                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                              netsh firewall set opmode disable
                                                                                                                                                                              29⤵
                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                              PID:5976
                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                              29⤵
                                                                                                                                                                                PID:5368
                                                                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                29⤵
                                                                                                                                                                                  PID:5828
                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                    30⤵
                                                                                                                                                                                      PID:64
                                                                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                      30⤵
                                                                                                                                                                                        PID:664
                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                          netsh firewall set opmode disable
                                                                                                                                                                                          31⤵
                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                          PID:116
                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                          31⤵
                                                                                                                                                                                            PID:6140
                                                                                                                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                            31⤵
                                                                                                                                                                                              PID:4016
                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                32⤵
                                                                                                                                                                                                  PID:5304
                                                                                                                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                    PID:5512
                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                        PID:5948
                                                                                                                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            netsh firewall set opmode disable
                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                              PID:5624
                                                                                                                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                    PID:6064
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                      PID:5196
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                            PID:5308
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                              netsh firewall set opmode disable
                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                PID:1784
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                        PID:2140
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                          netsh firewall set opmode disable
                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                          • Modifies Windows Firewall
                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                            PID:828
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                    PID:6164
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                        PID:6404
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                          PID:6472
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                            netsh firewall set opmode disable
                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                            PID:6620
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                              PID:6832
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                              42⤵
                                                                                                                                                                                                                                                                PID:6904
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                    PID:7044
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                      PID:7088
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                            PID:6264
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                              netsh firewall set opmode disable
                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                                              PID:6304
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                PID:6576
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                      PID:6384
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                        PID:6892
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                            PID:6696
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                              PID:2904
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                    PID:6872
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                                        PID:6780
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                          PID:6964
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                            netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                            PID:6296
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                PID:6948
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                    PID:5640
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                      PID:6168
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                          PID:6304
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                            PID:7080
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                              netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                              • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                              PID:2984
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                PID:6720
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                      PID:7072
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                        PID:6748
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                                                            PID:6612
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                              PID:5380
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7280
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                    PID:7352
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                        PID:7504
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7572
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                              PID:7848
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                PID:8004
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                  netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                  PID:8088
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5596
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7228
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6352
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7452
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4188
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6804
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                    netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                    PID:6312
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7288
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:8116
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7316
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8008
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7780
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                      netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                      PID:7356
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:532
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7504
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7852
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6316
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        netsh firewall set opmode disable
                                                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7876
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7520
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8048
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\B526A5\DECB07
                                                                                                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8108
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\B526A5\DECB07.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:3564
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3764
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:3888
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\BackgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                PID:3828
                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:1568
                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:4376
                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:3252
                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:2016
                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4924
                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:3620
                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3216
                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:2592
                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:3720
                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:3700
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:1744
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:2844
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:1300
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:856
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3356
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:696
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4944 -ip 4944
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:852
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5360
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5112
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5496
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5756
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5924
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6396
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6512
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6916
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7096
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7040
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6204
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7344
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7564
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7952
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7264
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7428
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6824
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8052
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6816
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8096
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8008

                                                                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0E57CAF1_Rar\JaffaCakes118_689ef0f2e6af8ad3d32ab57e1b21a5ee.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      a56698f6b0817086cd3e0e51e72450fd

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4b097291aef5a5f81052ac8e4a18a5ef5bb7a258

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      2fff4661ce462c7daa3feb4b93c74949683bee62809780d474beed63ff488136

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      3193833714d90ef38d52b787676cd5a4248225ce684fcce13f6c2c563ed97f6968b48bbd7930694b6c9dcaef955f35388c098c88536635fadb9a8ef3366de423

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\HtmlView.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      212KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      627f4934f3dd2bb7c0d2b3e89e39c3f6

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      c0f62b769ba8f846db9e92b9cfe42252178cbd36

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      9963c3650fb358ad31536d5a6f972d849194a7ceb70b5637fef134c76a4ff09c

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      b391c20ff3e4e7d76349382eda4eedf5c05a5ca9d1e971acc0969063dd5e5399bd348b1a75ce0ada66e2b7cbabf0acddd3e3bfe0e7e082548176c1dc51bf55ba

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\cnvpe.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e7d16f48ea3102391f30e626de055744

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      89d820e8b73d561e006c8bf7c72c411cee4670a7

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4ed364f79761bdd2ecbbe4fbf5d13034f63edd3b34f967a46cae7ebbe3c9fa22

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      368efb5aa4a3397f9b27e02c720ca8de899ae08e368c30129e7cf1dc3464ca0a4d15111232f5765a7c24b9ec3476555fb7a5771b1e5d1ada5073ed7418b9532a

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16e232e96f566e623b9ec4832c342f20

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      9a572e7722bee54b804e932d65e6412e0fe3ee4f

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      c3e74981280b5bd50b196806119e8d156a5493721e17128ac86d2f8d6a9727fd

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      be633ac6aba048d95672487628133ddd63d0462b6ce818671d8c49275f3f3efeede2487828f7ee3ba9ba20d969ccf4bf793a107cfc3c7d139969bf88cf96632a

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\eAPI.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      316KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      b6af7a492a22bbcbf9197295091291a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4ef062c75ba76aff1dc191511e32606aa07f295f

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      a53af08ac2a8c3bc7160dd8b5813fdfff1740eb08cc73b769051cfb8f5752636

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8f7d5a9e92f802b020d1a949190ec89788532e3ded68ca411bd7608153bef191afe7d30710a5c4d581f256c3726007ca8cc113eff27f5892ce536fa70267affa

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\internet.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      ce8bddb8a44b4a1a60c67759a5369a3b

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      a43aae5cbde236693fe2c2f0e00f5a5c3706766b

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      7147959370a3720449430692da54ec3c2de4af8fc58488a3773786e880b0a838

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      078ede6208fdefc8333b7012c7ef3d3ea7ea67374aa6c80dd1955583368e353d193625c648816337326c6920847c0cad6afea0e2098d2744b596e05f6698a063

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      db818bfe0241c5dda34a8e109bac66a9

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      5218cf5fea996f786ae23071364b1abc82e51841

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      09aad19ecb05ef5e64415a4fd7e48a64a9dc10d208607af6503bfeaa31af6310

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      3de615dc918e00be6adc90b9e5add9508092e62ca388f8d770b3c4554dda033b5635708283b963510b8b31b9a66810378f0b95a67ba22047b5828c5ff7b06377

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\shell.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e4ee9465b283089b80b11694a3e894b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dbde967d17e9031aaa9a5dec1ec7cddf9d869f27

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      7a281e98e894a5ea55f008e31606b61e5402107219e9dc2ea066bd5b2f40d752

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      6394401696e5b2df98828239047c1f165742db0e20dfc9a417f281043c4119371382f7abf4408605716d565a4d334b0213759f21621663296fc82bccac4c1c5e

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E_N4\spec.fne

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      05b0bdaa5f673e724a58e6286025514e

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      045b21926785af7d06eb01e2f110ce3320b2d07d

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      52be11135fed11a587097c2a60aa8af751b8b8fd9bde4ed3de969d74639e94aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      494a4d743e3ea5046f1773232990fad208bc99454b17e831bcfc848d7f7edca3ccce575b12d1ddc2d2932014444363d64ff1e6acd205300ff5628859fce0a391

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM.INI

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      257B

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      fdf54b474b44e0f128a5899be97189a9

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      31ebf1febebe639c1a8b5924d15c2b30e0647f84

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      39296d62251c3ba7ec537fa5be4c4eaf39cf2b59ca54678f920891d6b340036b

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      a21094de48a91183b5a18e0306d7c1ea6a0b54b815145c6e21d2bf4e457868a004790a0263c3a47083cbdafdcc9cdc48152c5efc68cb119d2afbcb93bac6be44

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\B526A5\DECB07.EXE

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                      689ef0f2e6af8ad3d32ab57e1b21a5ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                      3dd4725886252418e31e12ab069e73b12d6503b3

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                      52a7d48f7b130539b1f1c97736170ced7b48fe38473656a7d32405a9ca20a586

                                                                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                      c0695108cc48873f59aa149328320324f0d3ac208910465a57ef177173a0d6fc73cf62b0ebdc8f51c355134f09d7445328412d22ee6bb8c1490ad641bdd6bba2

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-83-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-172-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-149-0x00000000028F0000-0x00000000028F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-141-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-115-0x00000000027A0000-0x00000000027B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-116-0x00000000027D0000-0x00000000027EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-97-0x00000000026F0000-0x0000000002728000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-94-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-168-0x00000000028F0000-0x00000000028F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/400-171-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-280-0x0000000002390000-0x00000000023C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-324-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-270-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-281-0x0000000002B10000-0x0000000002B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-277-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-323-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/452-282-0x0000000002D50000-0x0000000002D6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-223-0x0000000002870000-0x0000000002881000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-268-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-269-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-214-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-220-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-221-0x0000000002820000-0x0000000002858000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-224-0x0000000002A60000-0x0000000002A7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1240-222-0x0000000002820000-0x0000000002858000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1712-386-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1712-380-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1712-402-0x00000000028C0000-0x00000000028D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1712-387-0x0000000002810000-0x0000000002848000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1712-403-0x0000000002A30000-0x0000000002A4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-135-0x00000000021E0000-0x0000000003213000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-167-0x00000000021E0000-0x0000000003213000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-160-0x0000000004ED0000-0x0000000004EEE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-157-0x0000000004DB0000-0x0000000004DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-151-0x0000000000620000-0x0000000000622000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-146-0x00000000021E0000-0x0000000003213000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-145-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-139-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-120-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-121-0x00000000021E0000-0x0000000003213000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-212-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-213-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-204-0x0000000000620000-0x0000000000622000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-162-0x00000000021E0000-0x0000000003213000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1984-154-0x0000000004860000-0x0000000004898000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-379-0x0000000002A60000-0x0000000002A7E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-378-0x0000000002A40000-0x0000000002A51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-423-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-375-0x00000000022F0000-0x0000000002328000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-360-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-372-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2300-424-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-292-0x0000000002AA0000-0x0000000002AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-293-0x0000000002AC0000-0x0000000002ADE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-358-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-359-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-291-0x0000000002310000-0x0000000002348000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-289-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2716-283-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-27-0x0000000003330000-0x0000000003332000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-47-0x00000000021B0000-0x00000000031E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-21-0x00000000021B0000-0x00000000031E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-18-0x00000000021B0000-0x00000000031E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-22-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-70-0x00000000021B0000-0x00000000031E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-117-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-118-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-45-0x0000000004D70000-0x0000000004D81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-23-0x0000000003330000-0x0000000003332000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-46-0x0000000004D90000-0x0000000004DAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-0-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-33-0x0000000003330000-0x0000000003332000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-34-0x0000000004800000-0x0000000004838000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-80-0x0000000003330000-0x0000000003332000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-24-0x0000000003340000-0x0000000003341000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-16-0x00000000021B0000-0x00000000031E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2996-1-0x00000000021B0000-0x00000000031E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      16.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-258-0x00000000050F0000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-259-0x00000000052D0000-0x00000000052EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-254-0x0000000004850000-0x0000000004888000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-239-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-406-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-225-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-308-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3444-307-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-197-0x0000000002C40000-0x0000000002C5E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-261-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-174-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-185-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-260-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-188-0x0000000002750000-0x0000000002788000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3600-196-0x0000000002980000-0x0000000002991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3612-143-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3612-150-0x0000000002C10000-0x0000000002C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3612-163-0x0000000002C10000-0x0000000002C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-325-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-405-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-353-0x0000000004670000-0x0000000004681000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-348-0x0000000003CC0000-0x0000000003CF8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-337-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-404-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4356-354-0x0000000004EE0000-0x0000000004EFE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-317-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-320-0x00000000028D0000-0x0000000002908000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-321-0x0000000002370000-0x0000000002381000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-322-0x0000000002910000-0x000000000292E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-373-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-374-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-318-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4944-319-0x00000000028D0000-0x0000000002908000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-78-0x0000000002800000-0x0000000002811000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-122-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-123-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-79-0x0000000002970000-0x000000000298E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-71-0x00000000026E0000-0x0000000002718000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-66-0x0000000010000000-0x000000001011D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5048-54-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                      268KB