Overview

overview

10

Static

static

3

Velocity.exe

windows10-2004-x64

10

Velocity.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/05/2026, 14:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Velocity.exe
  • Size 33.2MB
  • Sample260507-sby9xae19w
  • SHA256 6cb69e0a10dadd347271857f4c2e6eb8e1eed186dfc1f44018fd57fbd370b0ec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionxwormpersistencerattrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 3.0

C2

  • 77.93.28.66:5555

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Velocity.exe
    "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3336
    • C:\Users\Admin\AppData\Roaming\Velocity.exe
      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5172
      • C:\Users\Admin\AppData\Roaming\Velocity.exe
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5440
        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1080
        • C:\Users\Admin\AppData\Roaming\Velocity.exe
          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2588
          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:648
          • C:\Users\Admin\AppData\Roaming\Velocity.exe
            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:6116
            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3628
            • C:\Users\Admin\AppData\Roaming\Velocity.exe
              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1932
              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:740
              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:404
                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5828
                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:552
                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2224
                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5504
                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1724
                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:5052
                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:216
                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4300
                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3588
                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2620
                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2448
                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:728
                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5256
                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:5480
                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5660
                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3664
                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3660
                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:5620
                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3296
                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4536
                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4616
                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:700
                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3300
                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1248
                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3316
                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:2156
                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:464
                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5252
                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6020
                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:2544
                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1532
                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5212
                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5140
                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1336
                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5188
                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:452
                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:632
                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1064
                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2876
                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1696
                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3488
                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5036
                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3960
                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1912
                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3892
                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5064
                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3756
                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3936
                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4848
                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  PID:2536
                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4460
                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    PID:6136
                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                      34⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1604
                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                      34⤵
                                                                        PID:216
                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                          35⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3768
                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          PID:5224
                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                            36⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4556
                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                            36⤵
                                                                              PID:3712
                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                37⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1328
                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                37⤵
                                                                                • Checks computer location settings
                                                                                PID:6132
                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                  38⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5864
                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                  38⤵
                                                                                    PID:3048
                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                      39⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4600
                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                      39⤵
                                                                                        PID:4216
                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                          40⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5956
                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                          40⤵
                                                                                            PID:4484
                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                              41⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4616
                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                              41⤵
                                                                                              • Checks computer location settings
                                                                                              PID:2940
                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                42⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5260
                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                42⤵
                                                                                                • Checks computer location settings
                                                                                                PID:2980
                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                  43⤵
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5516
                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                  43⤵
                                                                                                    PID:1488
                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                      44⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3532
                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                      44⤵
                                                                                                        PID:5196
                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                          45⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2056
                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                          45⤵
                                                                                                            PID:3876
                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                              46⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2576
                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                              46⤵
                                                                                                                PID:4652
                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                  47⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1548
                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                  47⤵
                                                                                                                    PID:5936
                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                      48⤵
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4204
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                      48⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:3140
                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                        49⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:3092
                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                        49⤵
                                                                                                                          PID:212
                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                            50⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:3804
                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                            50⤵
                                                                                                                              PID:984
                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                51⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:756
                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                51⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:5700
                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                  52⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:5976
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                  52⤵
                                                                                                                                    PID:2692
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                      53⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4148
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                      53⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:956
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                        54⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:1444
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                        54⤵
                                                                                                                                          PID:1724
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                            55⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2352
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                            55⤵
                                                                                                                                              PID:1068
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                56⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:5644
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                56⤵
                                                                                                                                                  PID:2592
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                    57⤵
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:2556
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                    57⤵
                                                                                                                                                      PID:1328
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                        58⤵
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:5864
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                        58⤵
                                                                                                                                                          PID:764
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                            59⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:5776
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                            59⤵
                                                                                                                                                              PID:1092
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                60⤵
                                                                                                                                                                  PID:6128
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                  60⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  PID:5756
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                    61⤵
                                                                                                                                                                      PID:5388
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                      61⤵
                                                                                                                                                                        PID:3348
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                          62⤵
                                                                                                                                                                            PID:2096
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                            62⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:4392
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                              63⤵
                                                                                                                                                                                PID:1288
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                63⤵
                                                                                                                                                                                  PID:5000
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                    64⤵
                                                                                                                                                                                      PID:3084
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                      64⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      PID:776
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                        65⤵
                                                                                                                                                                                          PID:4144
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                          65⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          PID:4660
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                            66⤵
                                                                                                                                                                                              PID:804
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                              66⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              PID:4876
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                67⤵
                                                                                                                                                                                                  PID:1456
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                    PID:648
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:4000
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                  PID:5468
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                        PID:4232
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                              PID:756
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              PID:3724
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                76⤵
                                                                                                                                                                                                                                                  PID:5296
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                              PID:4964
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                                                        PID:2768
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                        80⤵
                                                                                                                                                                                                                                                                          PID:4312
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                              PID:1244
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                                                                PID:5004
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          PID:3808
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              PID:5780
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                  PID:116
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                              PID:4708
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                    PID:804
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                              PID:5716
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                PID:2532
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                    PID:4556
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                      PID:1924
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                                                                                                                                                                PID:5768
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1796
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5316
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3784
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3916
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5516
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                              PID:3512
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  PID:372
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5044
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3960
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3156
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Velocity.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\xwormm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\xwormm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\xwormm.exe'
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'xwormm.exe'
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\xwormm.exe'
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1744

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Velocity.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Velocity.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 654B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 944B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3a681958a1c2e58fe9c2de289a704a172a20671264b70c728fe9691cda96fb54
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 944B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      __PSScriptPolicyTest_b1ei331y.fa3.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1ei331y.fa3.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Velocity.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 33.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 224e32fc153fd0788e16e516a54b3690c894c937d412558a2610bce7777f3d9a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\qweqew214.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 81KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5f8a3f619b5addfa70cba5285d4d35ebdaba728a03e105fdf1350010110bc933
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      xwormm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\xwormm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 58KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c35e782bd75b610002493dff861cb509ab1ce1c7a22f1da145d3fff73723000c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/216-125-0x0000000001150000-0x000000000115C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/404-99-0x0000000004CE0000-0x0000000004CEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/452-176-0x0000000004C20000-0x0000000004C2C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/464-168-0x0000000001660000-0x000000000166C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/552-102-0x0000000004330000-0x000000000433C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/632-189-0x0000000002F40000-0x0000000002F4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/648-92-0x0000000002B60000-0x0000000002B6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/700-146-0x0000000005110000-0x000000000511C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/728-123-0x0000000004600000-0x000000000460C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/740-106-0x0000000000F70000-0x0000000000F7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1064-180-0x0000000003600000-0x000000000360C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1080-86-0x0000000000810000-0x000000000081C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1248-150-0x0000000004DC0000-0x0000000004DCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1336-170-0x0000000003340000-0x000000000334C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1364-35-0x000001A3DA1E0000-0x000001A3DA202000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1364-49-0x000001A3C1C00000-0x000001A3C1C0C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1364-50-0x000001A3DA340000-0x000001A3DA3AB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1532-178-0x0000000001460000-0x000000000146C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1696-184-0x000000001CDE0000-0x000000001CDEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1724-121-0x00000000013F0000-0x00000000013FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1912-190-0x0000000002BE0000-0x0000000002BEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1932-95-0x0000000004720000-0x000000000472C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2156-153-0x0000000004480000-0x000000000448C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2224-117-0x0000000002200000-0x000000000220C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2448-134-0x0000000002DF0000-0x0000000002DFC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2544-162-0x0000000002C50000-0x0000000002C5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2588-84-0x0000000004C10000-0x0000000004C1C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2620-119-0x00000000044D0000-0x00000000044DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2876-191-0x0000000002CD0000-0x0000000002CDC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3144-79-0x0000022B15B00000-0x0000022B15B6B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3144-78-0x0000022B14100000-0x0000022B1410C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3296-154-0x0000000000B30000-0x0000000000B3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3300-160-0x0000000002A40000-0x0000000002A4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3316-166-0x0000000000DB0000-0x0000000000DBC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3336-24-0x0000000004AD0000-0x0000000004ADC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3336-0-0x0000000000A50000-0x0000000002B7E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3588-129-0x00000000013C0000-0x00000000013CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3628-97-0x0000000001170000-0x000000000117C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3660-148-0x00000000014D0000-0x00000000014DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3664-131-0x0000000003160000-0x000000000316C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4224-53-0x00000000045F0000-0x00000000045FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4224-26-0x0000000000310000-0x000000000241A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4300-113-0x00000000031D0000-0x00000000031DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4536-142-0x00000000035B0000-0x00000000035BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4616-156-0x0000000000B00000-0x0000000000B0C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4824-65-0x000001D61DD40000-0x000001D61DD4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4824-66-0x000001D636450000-0x000001D6364BB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5036-188-0x0000000002CC0000-0x0000000002CCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5052-109-0x0000000004D40000-0x0000000004D4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5064-192-0x0000000004FC0000-0x0000000004FCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5140-182-0x0000000002F20000-0x0000000002F2C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5172-46-0x0000000000530000-0x000000000054A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5172-114-0x0000000000CF0000-0x0000000000CFC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5172-115-0x00000000024F0000-0x000000000255B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5188-186-0x0000000001040000-0x000000000104C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5212-165-0x0000000003420000-0x000000000342C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5252-158-0x0000000004990000-0x000000000499C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5256-138-0x0000000001580000-0x000000000158C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5360-82-0x000000001B610000-0x000000001B620000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5360-91-0x0000000001050000-0x000000000105C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5360-140-0x000000001C1C0000-0x000000001C22B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5360-133-0x000000001B610000-0x000000001B620000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5360-25-0x0000000000890000-0x00000000008A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5440-76-0x0000000003870000-0x000000000387C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5480-127-0x0000000002A30000-0x0000000002A3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5504-105-0x0000000002FF0000-0x0000000002FFC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5620-136-0x0000000004930000-0x000000000493C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5660-144-0x00000000022C0000-0x00000000022CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5828-111-0x0000000002840000-0x000000000284C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6020-174-0x0000000000D60000-0x0000000000D6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/6116-90-0x0000000002DC0000-0x0000000002DCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download