Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2025 03:38

General

  • Target

    Cotización.exe

  • Size

    633KB

  • MD5

    a3d33d33f8b10595c252ee8e61a8892c

  • SHA1

    f8bf529297b99ebdd0d6214a1a8a20bffb1bd875

  • SHA256

    fe0c0a5da033e86e09a721070bb2e1116a28160aaffd803b8e65a57ed25e62c1

  • SHA512

    5a8d8cfcb0ad0e73ce3a4ca2d23a8cb55216f97b1d4f490b3a7beee963e494e8c122fd7ec70a32eef8c1eb9b6b4e86da4cf2207beba6324d70fada7c36303bf0

  • SSDEEP

    6144:pe3DUlId51RnG/LXJKIA5ZaPLi+bWVSBKtnfuvOVYER0u+GIIIIIIIhIIIIIIIIB:M3DkId5HnWLXMJABWVbnf/Vjm5a/s

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

2.58.56.182:2404

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GM05WY

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 26 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cotización.exe
    "C:\Users\Admin\AppData\Local\Temp\Cotización.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C cmd.exe /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Cotización" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Cotización.exe\"" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\system32\cmd.exe
        cmd.exe /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Cotización" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Cotización.exe\"" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\system32\reg.exe
          reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Cotización" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Cotización.exe\"" /f
          4⤵
          • Adds Run key to start application
          PID:2836
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
      2⤵
        PID:2828
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        2⤵
          PID:2932
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
          2⤵
            PID:2716
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:2824
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
              2⤵
                PID:2796
              • C:\Windows\System32\calc.exe
                "C:\Windows\System32\calc.exe"
                2⤵
                  PID:2580
                • C:\Windows\System32\svchost.exe
                  "C:\Windows\System32\svchost.exe"
                  2⤵
                    PID:2312
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe"
                    2⤵
                      PID:2644
                    • C:\Windows\System32\notepad.exe
                      "C:\Windows\System32\notepad.exe"
                      2⤵
                        PID:1272
                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:748
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                        2⤵
                          PID:3004
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                          2⤵
                            PID:2332
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                            2⤵
                              PID:2240
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                              2⤵
                                PID:2080
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                2⤵
                                  PID:1476
                                • C:\Windows\System32\calc.exe
                                  "C:\Windows\System32\calc.exe"
                                  2⤵
                                    PID:3024
                                  • C:\Windows\System32\svchost.exe
                                    "C:\Windows\System32\svchost.exe"
                                    2⤵
                                      PID:988
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe"
                                      2⤵
                                        PID:2544
                                      • C:\Windows\System32\notepad.exe
                                        "C:\Windows\System32\notepad.exe"
                                        2⤵
                                          PID:1008
                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                          2⤵
                                            PID:1772
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                            2⤵
                                              PID:840
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                              2⤵
                                                PID:2128
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                2⤵
                                                  PID:2400
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                  2⤵
                                                    PID:1876
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                    2⤵
                                                      PID:1192
                                                    • C:\Windows\System32\calc.exe
                                                      "C:\Windows\System32\calc.exe"
                                                      2⤵
                                                        PID:1924
                                                      • C:\Windows\System32\svchost.exe
                                                        "C:\Windows\System32\svchost.exe"
                                                        2⤵
                                                          PID:1936
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe"
                                                          2⤵
                                                            PID:2408
                                                          • C:\Windows\System32\notepad.exe
                                                            "C:\Windows\System32\notepad.exe"
                                                            2⤵
                                                              PID:2192
                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                              2⤵
                                                                PID:2732
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                2⤵
                                                                  PID:568
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                  2⤵
                                                                    PID:2124
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                    2⤵
                                                                      PID:2964
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                      2⤵
                                                                        PID:2996
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                        2⤵
                                                                          PID:2880
                                                                        • C:\Windows\System32\calc.exe
                                                                          "C:\Windows\System32\calc.exe"
                                                                          2⤵
                                                                            PID:2704
                                                                          • C:\Windows\System32\svchost.exe
                                                                            "C:\Windows\System32\svchost.exe"
                                                                            2⤵
                                                                              PID:2776
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe"
                                                                              2⤵
                                                                                PID:2820
                                                                              • C:\Windows\System32\notepad.exe
                                                                                "C:\Windows\System32\notepad.exe"
                                                                                2⤵
                                                                                  PID:544
                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                  2⤵
                                                                                    PID:2680
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                    2⤵
                                                                                      PID:2216
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                      2⤵
                                                                                        PID:440
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                        2⤵
                                                                                          PID:2468
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                          2⤵
                                                                                            PID:2040
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                            2⤵
                                                                                              PID:352
                                                                                            • C:\Windows\System32\calc.exe
                                                                                              "C:\Windows\System32\calc.exe"
                                                                                              2⤵
                                                                                                PID:1300
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                "C:\Windows\System32\svchost.exe"
                                                                                                2⤵
                                                                                                  PID:1920
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                  2⤵
                                                                                                    PID:1548
                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                    "C:\Windows\System32\notepad.exe"
                                                                                                    2⤵
                                                                                                      PID:2856
                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                      2⤵
                                                                                                        PID:2696
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                        2⤵
                                                                                                          PID:2752
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                          2⤵
                                                                                                            PID:2900
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                            2⤵
                                                                                                              PID:2892
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                              2⤵
                                                                                                                PID:2120
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                2⤵
                                                                                                                  PID:2504
                                                                                                                • C:\Windows\System32\calc.exe
                                                                                                                  "C:\Windows\System32\calc.exe"
                                                                                                                  2⤵
                                                                                                                    PID:640
                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                    "C:\Windows\System32\svchost.exe"
                                                                                                                    2⤵
                                                                                                                      PID:324
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                      2⤵
                                                                                                                        PID:1660
                                                                                                                      • C:\Windows\System32\notepad.exe
                                                                                                                        "C:\Windows\System32\notepad.exe"
                                                                                                                        2⤵
                                                                                                                          PID:604
                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                          2⤵
                                                                                                                            PID:1392
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                            2⤵
                                                                                                                              PID:2720
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                              2⤵
                                                                                                                                PID:1556
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                2⤵
                                                                                                                                  PID:2456
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:1096
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:2928
                                                                                                                                    • C:\Windows\System32\calc.exe
                                                                                                                                      "C:\Windows\System32\calc.exe"
                                                                                                                                      2⤵
                                                                                                                                        PID:1532
                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                        "C:\Windows\System32\svchost.exe"
                                                                                                                                        2⤵
                                                                                                                                          PID:2864
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                          2⤵
                                                                                                                                            PID:2316
                                                                                                                                          • C:\Windows\System32\notepad.exe
                                                                                                                                            "C:\Windows\System32\notepad.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:1336
                                                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                              2⤵
                                                                                                                                                PID:2744
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1196
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:904
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1068
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:740
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1696
                                                                                                                                                        • C:\Windows\System32\calc.exe
                                                                                                                                                          "C:\Windows\System32\calc.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1704
                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                            "C:\Windows\System32\svchost.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2624
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2548
                                                                                                                                                              • C:\Windows\System32\notepad.exe
                                                                                                                                                                "C:\Windows\System32\notepad.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1552
                                                                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2724
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:616
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2628
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2636
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2656
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1208
                                                                                                                                                                            • C:\Windows\System32\calc.exe
                                                                                                                                                                              "C:\Windows\System32\calc.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1368
                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:292
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:868
                                                                                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                                                                                    "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:300
                                                                                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1448
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2788
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2736
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3060
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1984
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                • C:\Windows\System32\calc.exe
                                                                                                                                                                                                  "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2208
                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                      • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                        "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2276
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2392
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2148
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2896
                                                                                                                                                                                                                    • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                      "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                        "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3028
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                                          • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                            "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:336
                                                                                                                                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2740
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2100
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:668
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                        • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2336
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1988
                                                                                                                                                                                                                                              • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1648
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2632
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1564
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2428
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                                            • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3140
                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3196
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3252
                                                                                                                                                                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3308
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:3364
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:3536
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:3652
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:3660
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3716
                                                                                                                                                                                                                                                                                • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:3772
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3884
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:3996
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1716
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:2360
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2200
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3108
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3228
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:3584
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:3748
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:3668
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:3788
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:4028
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:3208
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:3240
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3268
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3388
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3508
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4016
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3764
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3568
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3892
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4076
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2364
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:628
                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3276
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3520
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3712
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3548
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4008
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3640
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\calc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\calc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\notepad.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4784

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\0325bcf5-48fa-4cbd-8a46-25a198ff5337.tmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          541f52e24fe1ef9f8e12377a6ccae0c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189898bb2dcae7d5a6057bc2d98b8b450afaebb6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\6c55eb09-10d1-4cc6-bfc4-80bfe145ad8e.tmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2cc86b681f2cd1d9f095584fd3153a61

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2a0ac7262fb88908a453bc125c5c3fc72b8d490e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ASPNETSetup_00000.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          97e1405d48e602693aedc8701d01f14d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0a9182bcced850600593167197f7114ebe39ea6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b5326bb153a9d10d3d3dc2707f0478c1e84cac8403ebda45bee242fbb1ae5faa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          0a92a9a5f3474e4cc1f36fe656fc2ed6dfc8e5a915123ea530cab788acf3e675dc5ac590fb498227029232c0221e8ba5d756a471f163f29f4b0264a637e1e41c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ASPNETSetup_00001.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b02740a2f6a93b9dd719d7fd26899f5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1369e4085962344ef7a26e393248f0f42fab541a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240049bb246b519bb969fbe5a5dab7bb5012ac212224b619a121a1a057d2ffc1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          534d0cba694e6b3402825b16c35c8ffac13d637ecbde482b39220a8ddfe9938ded396dcb7e57ddcaccfdba0f891ea968e19384c41f4380346e6fd9a4f71b52a0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Admin.bmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          343fa15c150a516b20cc9f787cfd530e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          369e8ac39d762e531d961c58b8c5dc84d19ba989

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d632e9dbacdcd8f6b86ba011ed6b23f961d104869654caa764216ea57a916524

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7726bd196cfee176f3d2002e30d353f991ffeafda90bac23d0b44c84c104aa263b0c78f390dd85833635667a3ca3863d2e8cd806dad5751f7984b2d34cafdc57

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Cotización.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          633KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a3d33d33f8b10595c252ee8e61a8892c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f8bf529297b99ebdd0d6214a1a8a20bffb1bd875

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fe0c0a5da033e86e09a721070bb2e1116a28160aaffd803b8e65a57ed25e62c1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5a8d8cfcb0ad0e73ce3a4ca2d23a8cb55216f97b1d4f490b3a7beee963e494e8c122fd7ec70a32eef8c1eb9b6b4e86da4cf2207beba6324d70fada7c36303bf0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\JavaDeployReg.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          612a650d1c773ee52d62546e66ff5918

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          a7479722bea44f8719b651ba69aa337d60da4290

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9e0774deea09130ce23833cc3f0118e8dd06750e3570a230b199c87cdf354c00

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5882a9d5340d0197c660d0774f22a82f03a0fc73d14476c47d3ab86dfea8f80850bfb8af7a9433b120f4728da4889083086666145b3e2390966e6816ad981483

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft .NET Framework 4.7.2 Setup_20240903_051533592-MSI_netfx_Full_x64.msi.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e5a9b4e671f41579adafc82b8dfc3054

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5ae21d75ae77a91c0a7adb33cb84ac43032f592f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8cf73d246bd9bea29501ff7fa5c35987035cdbd4434eb2fd9218db0ff8a90905

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c374e9f4b16fcf1c2d4f3b1958286fcaa7345e07114864a63fd845b5906710ed906f600a3aa675cd2a4ce360a811dbec1fcaec007efb6d867206f9af5620a3c1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft .NET Framework 4.7.2 Setup_20240903_051533592.html

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          02af43a7ccddec3d83c42f4ca7ceac21

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f1c63a54e6e3d036f4ef8739b70e35951e57421b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ad06f331c591a92a97ef4031a6c4de7407f187834e417dd65b6e0016b3d7a6a1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cb5c77f7965ccce63afd8b2456b6093177ea7b9bb796e9c887fafe90178af0b6996373d86ae5c2c18f2f05ab379a0e9b56ed59df1746dcbe0974b0e140faff0d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\chrome_installer.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          05e62c456aa18d4ec94ea3a62c787a7d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e0aa924bf9125b20351cf331525b0f5d7c13d425

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ad1a8cc051d1112321fcb427827ee2dc9b07f651eac15cffcfaea53903f5217b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cdecd7ba1636b2f3afb8a6b50c661b200358f11ad885620559a61e27eeaa94cded171e9937e323a80a28963b0da9c57f6f9ef0581c3159ec7d11ee2aaaf2aeff

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          35b5330cf96f8ad5cfadcc89c182b131

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          127a1fae28d02070db8a48107327c063ea19c0f4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          06a188e9211d71149fc7194ec2abaf6ffa11e8328c4d11fe359dae4f34aa9a4c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          eabf71520fc7b1751bf487016414c2740cc3f8fa6616d9f724c485ec05c042e56b6dd47a1d5425e338de053e72a951d64c39689c0d212b34c1a48a2dfbdfb6ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_SetupUtility.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          efd79c10228af2f35efb50331ae124c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          52a1db9000f8735a9a454871973d0fcf66dfce4c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          42f45922029781d3895d3719ff384fb5706bc1e7132bc5585c1a1c6a4c0c3263

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d3821df7ac0ea4da6d2dbfbf82f1beaa2e709f9b71108445e63d394a99582f036ed905251b61fba4c64c584c4a341a7626954550d51c6b0ec75d35d714a1d4f9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistMSI1E10.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          422KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3fd3d31059d46112d75ff5a83662b607

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1d0144ae60672cda5b791baa2916aa01676e2dd9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b171d25a1ec23963429fb5eaf076865f634260bb7ccdaf5feaf4f1f32a81d6a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9c56b78315778bb1aaa88dbb86404190af720a252d7be6cf157968ca5deb920d2fb384eadc02210dae44eaefac599ac6af92205d750c551d6ad4754eec290910

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistMSI1E4E.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          410KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7f6c9d8c6a8b5e5a1a1da07014d3ac44

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          fbd408e0f8b1b4a0200bcc2594185f173d7014de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          901ebd2e9e6cfa922d6d0b76321c554a02aa9cfe6803b2af3d7b991d6d10f56b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d624d15133d967195cef22bdc1cae2989f6e31ae6f6eca67783fa8db7736950deb3f4341d803c363cf3ed7e631bfe5ce8e25940f69130352d01ae46dc273e63f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistUI1E10.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          89809e915515d95747185bcdb552e5b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e16ce769aad287e02fb47923da4c4309d2362d66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f55b8d4c27734c53209e2b52666d3586fb90b902d4832de76969c060f4226b6b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          62f139ff28842b3ba73c290f87e6ac4ba0f69273d85ab41dbd31ab841ec759fb021c7be3692336c4d29121a93a4f6ff6fa9f15a4b05b87c8b3cc49da6687ee78

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistUI1E4E.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6ff20221d7c289caac4fe478872f2c41

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          767d3235608428524f5491948e242092dd6b7766

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          86a6b650e145866e25f1c75aa54aadc22a70a488f7c9b451e17a91041e84ae0a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dbeb52f07bfd83ed00da63bb7f1546cc2cc1d1ad185ee2a91c0375f7295ef59c8058cbf0414c89c52302066530967ba072338bcb290a509859f579cde7c5b369

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_wcf_CA_smci_20240903_051546_680.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          dcbfd152fe577ca265bc93f4dc85b4a6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88ddfb6551e71f2d56f229e9c6992ccfe47e59b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          66019b5d8057e8742fd028fe3013793a92f0f29532d79c682c0afba2a0d25403

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          860d519a5ad172941dfe82536ebdfc3e89b96f454adb086917c2fa3ba0cd646fec663fd6f4f0df25e2579493f47ceb8c727065bc69c6f3bab1af5feb6d509686

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_wcf_CA_smci_20240903_051547_101.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          bc78cfcba1defade4560c6eaf560b5b7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          33b518715db36596ba152b478e0b340a564e1756

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d16182d4b64ee069711368f342b6a98a527e2321e30643dbc610e3594bc945fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          58f3086ccd5d11c88cf8332688a9aadf7a156934848fa5088d4c3b46a0ea67a3ba2cc9279435d410c951c10f6d6fee1b49d10a8cc25d028a4f34fd0a11b21b83

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\java_install.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          170KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          61698f2ba07bda2ba323140f20b28e28

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d3e46602b6e042abdfb6a8630ccaff23801cd104

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          51c06f89c259219fd364b1a36991964e772e968873496a4d61532d488b2cb8c0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          eb7f3dc17e49d2c2191fd6eb235e22ef3aa63157f90da42af3e6653e174e129e663b9c1eac8798d770a99ecdad4230754f07c84a96a73d85e6c8ef14aeb1cfeb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\java_install_reg.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36cf8d512a14fd2c5263e06775f2da47

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3e8ae2e7855ac773837272177b985f1705f65667

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c3d0d9bf10e08fc22138cb4fd1d0fdf59f37cd2e12e3ff779ece43259f861cc9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e61afb7cf48065a5ad087dcd9ae7ae2c46552cb68c1bd1bd8f9df51b8f0eb040e6e69423d45b09166d16959e7bd1e247d7dd02552da8ec40d9bc805883e58725

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\jawshtml.html

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          13B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          b2a4bc176e9f29b0c439ef9a53a62a1a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1ae520cbbf7e14af867232784194366b3d1c3f34

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\jusched.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          347B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8412e1056750ccb7ef9c0f5b67c60a05

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88c20a2957a0958835144a8acdd38cdade23ff7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8142f71aa326ec95095ce97133b4e89684e8d87c4dcd981ecbfa0acda6993d21

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11012d61151b3cb54fe2d847b5828297705b90515fcd9af548cd91c47b5118b42ad31d434c02ae4f5b37524def4207aa5e475979acc36c470a9ea2a607e1928b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\lpksetup-20240903-052344-0.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          33KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          f2e9c74594fbf22ee0c8abaa8cb7424e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ee9ce7c8ab164ea6dff88a40f5a7de11d655be54

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          035783f174fe0896e133fdf178c42a9daf33e214adbab8f480ea97747b350e2b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          73538813aa5da1aaea44544314f5b2fcba7dce2cf0b77ec0fca3c5a6f9a7a4aaa31786cb4a7e691a5a93278a830ab15b888e57898e7a17730f8ba10d44782e2d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\lpksetup-20240903-052520-0.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          34KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          20c95e6316744b0765716fb2529251a9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          477c8c2943f7f9d5fb4d303165b3df161bc220d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          c901f337731265eb5176fdfc5674d4eee613a58f067168365559ba47d27e605c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          d0a186e284865ff89ab555d4ce5818273273c5f58fcb161977d6840595b923d8167452b6f2bfcc79276abfd5a3da0ec22506b9209f7fa7d828175400cd120731

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\lpksetup-20240903-052652-0.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1cda450e802927d1b0d0fd0df5103ad9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          45bbf9ec5c7164ab6af9f05e12c2b940d297852c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5349cccd10c366ea96560ec77fdd551b417e31c23ef33543cadebd28d6cb153e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9a2c19ba880e6dbee91edb85521e34f0804d8beb33b3aa1548a72e22b53e17d8c5026d3669af4b78bcfb9b1f6b945fa1d3fd807a8c6eea381cbea56823dfa6aa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\lpksetup-20240903-052833-0.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          35KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9dd97d3bf136204b8cd46b64de4e6f07

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          af4b8e360fc98c4d0855e209ef4df8c5ff49b985

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          57811823a3c11e5bdae9d89f594320f0162fd213031343630cc9930da0d348fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6a359d5470d8bad92d24be335515254f8080c9c85e6a4accbc178286287c05148b878b8cf153b1a39735ab97f57f392251698216bf2882b601628016ff72a171

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\lpksetup-20240903-053008-0.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          ae639c541e8a910955677d55f6883af4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5d09705f2c94f56f7f7690453b4f204bdf1d33af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8c3bbc2b065b2551ad6d45def93473bbb7b9dfed66c8191f8c21fe44f3cd9d8e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6239aec7448d331cf1841aa93d7d54726fb43e068c158407427cc058c2e1d9dddb5704669c7ed1b92f99ac8f11925b28ccecc7f884b4682b01513b556e102f8d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/748-2816-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/748-190-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1784-0-0x0000000000190000-0x00000000001A0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2828-41-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2828-43-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2828-45-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2828-47-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2828-37-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2828-39-0x0000000000400000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          512KB