xworm | 6cb69e0a10dadd347271857f4c2e6eb8e1eed186dfc1f44018fd57fbd370b0ec

Analysis

max time kernel
131s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 33.2MB
Sample260507-sby9xae19w
SHA256 6cb69e0a10dadd347271857f4c2e6eb8e1eed186dfc1f44018fd57fbd370b0ec
MD5 b033c726b633b45cc6f5eb46ff76d0a0
SHA1 733f503b82e11b57a4f0b999012a7cc618cb2bca
SHA512 75ffef781ffddae092c49fe1b3da80814697e04b7b5327419149b51ea3f7ae63689bad9a53f3063ceba643b5ea355af9345abd7648beb5958e1f982fe5ba0c50
SSDEEP 786432:Yg6eTcKMsDDPrjjblSHqJOLyhi7lBRZPD06XyuYOjgLe2+:YfmDPrfKOV0BR1iwE
TLSH
T14B77234611C99428F692787DFFF4A52875D92DC0D7E638ABE354700EC9BEBD88220DC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm rat trojan

Malware Config

Extracted

Family

xworm

Version

77.93.28.66:5555

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0009000000025eb6-16.dat	family_xworm
behavioral2/memory/3696-26-0x00000000009B0000-0x00000000009C4000-memory.dmp	family_xworm
behavioral2/files/0x002400000002b12a-32.dat	family_xworm
behavioral2/memory/4408-39-0x00000000006E0000-0x00000000006FA000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5080	powershell.exe
4112	powershell.exe
4136	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwormm.lnk	xwormm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwormm.lnk	xwormm.exe

Executes dropped EXE 64 IoCs

pid	Process
3200	Velocity.exe
3696	xwormm.exe
4408	qweqew214.exe
4372	Velocity.exe
5012	qweqew214.exe
1672	Velocity.exe
232	qweqew214.exe
564	Velocity.exe
3204	qweqew214.exe
836	Velocity.exe
580	qweqew214.exe
4024	Velocity.exe
4428	qweqew214.exe
3184	Velocity.exe
3900	qweqew214.exe
1828	Velocity.exe
1424	qweqew214.exe
2416	Velocity.exe
3164	qweqew214.exe
4188	Velocity.exe
4772	qweqew214.exe
3648	Velocity.exe
3408	qweqew214.exe
4528	Velocity.exe
2192	qweqew214.exe
3308	Velocity.exe
2720	qweqew214.exe
1256	Velocity.exe
2704	qweqew214.exe
4684	Velocity.exe
2648	qweqew214.exe
5000	Velocity.exe
4552	qweqew214.exe
3904	Velocity.exe
4792	qweqew214.exe
4812	Velocity.exe
3740	qweqew214.exe
3980	Velocity.exe
2644	qweqew214.exe
920	Velocity.exe
4800	qweqew214.exe
3220	Velocity.exe
2700	qweqew214.exe
828	Velocity.exe
3240	qweqew214.exe
2356	Velocity.exe
1952	qweqew214.exe
4068	Velocity.exe
1684	qweqew214.exe
2792	Velocity.exe
4972	qweqew214.exe
1880	Velocity.exe
1236	qweqew214.exe
4748	Velocity.exe
2688	qweqew214.exe
4888	Velocity.exe
4532	qweqew214.exe
4792	Velocity.exe
3732	qweqew214.exe
2348	Velocity.exe
4504	qweqew214.exe
4408	Velocity.exe
4480	qweqew214.exe
3228	Velocity.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5080	powershell.exe
5080	powershell.exe
4112	powershell.exe
4112	powershell.exe
4136	powershell.exe
4136	powershell.exe
3696	xwormm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	xwormm.exe
Token: SeDebugPrivilege	4408	qweqew214.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	5012	qweqew214.exe
Token: SeDebugPrivilege	232	qweqew214.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	3204	qweqew214.exe
Token: SeDebugPrivilege	580	qweqew214.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	4428	qweqew214.exe
Token: SeDebugPrivilege	3900	qweqew214.exe
Token: SeDebugPrivilege	3696	xwormm.exe
Token: SeDebugPrivilege	1424	qweqew214.exe
Token: SeDebugPrivilege	3164	qweqew214.exe
Token: SeDebugPrivilege	4772	qweqew214.exe
Token: SeDebugPrivilege	3408	qweqew214.exe
Token: SeDebugPrivilege	2192	qweqew214.exe
Token: SeDebugPrivilege	2720	qweqew214.exe
Token: SeDebugPrivilege	2704	qweqew214.exe
Token: SeDebugPrivilege	2648	qweqew214.exe
Token: SeDebugPrivilege	4552	qweqew214.exe
Token: SeDebugPrivilege	4792	qweqew214.exe
Token: SeDebugPrivilege	3740	qweqew214.exe
Token: SeDebugPrivilege	2644	qweqew214.exe
Token: SeDebugPrivilege	4800	qweqew214.exe
Token: SeDebugPrivilege	2700	qweqew214.exe
Token: SeDebugPrivilege	3240	qweqew214.exe
Token: SeDebugPrivilege	1952	qweqew214.exe
Token: SeDebugPrivilege	1684	qweqew214.exe
Token: SeDebugPrivilege	4972	qweqew214.exe
Token: SeDebugPrivilege	1236	qweqew214.exe
Token: SeDebugPrivilege	2688	qweqew214.exe
Token: SeDebugPrivilege	4532	qweqew214.exe
Token: SeDebugPrivilege	3732	qweqew214.exe
Token: SeDebugPrivilege	4504	qweqew214.exe
Token: SeDebugPrivilege	4480	qweqew214.exe
Token: SeDebugPrivilege	3768	qweqew214.exe
Token: SeDebugPrivilege	4104	qweqew214.exe
Token: SeDebugPrivilege	904	qweqew214.exe
Token: SeDebugPrivilege	788	qweqew214.exe
Token: SeDebugPrivilege	4808	qweqew214.exe
Token: SeDebugPrivilege	5072	qweqew214.exe
Token: SeDebugPrivilege	356	qweqew214.exe
Token: SeDebugPrivilege	1240	qweqew214.exe
Token: SeDebugPrivilege	3684	qweqew214.exe
Token: SeDebugPrivilege	3432	qweqew214.exe
Token: SeDebugPrivilege	2856	qweqew214.exe
Token: SeDebugPrivilege	924	qweqew214.exe
Token: SeDebugPrivilege	4216	qweqew214.exe
Token: SeDebugPrivilege	3128	qweqew214.exe
Token: SeDebugPrivilege	5112	qweqew214.exe
Token: SeDebugPrivilege	3292	qweqew214.exe
Token: SeDebugPrivilege	4428	qweqew214.exe
Token: SeDebugPrivilege	2804	qweqew214.exe
Token: SeDebugPrivilege	2156	qweqew214.exe
Token: SeDebugPrivilege	4352	qweqew214.exe
Token: SeDebugPrivilege	2596	qweqew214.exe
Token: SeDebugPrivilege	2452	qweqew214.exe
Token: SeDebugPrivilege	3932	qweqew214.exe
Token: SeDebugPrivilege	1060	qweqew214.exe
Token: SeDebugPrivilege	4688	qweqew214.exe
Token: SeDebugPrivilege	996	qweqew214.exe
Token: SeDebugPrivilege	4488	qweqew214.exe
Token: SeDebugPrivilege	1188	qweqew214.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3696	xwormm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3200	1744	Velocity.exe	80
PID 1744 wrote to memory of 3696	1744	Velocity.exe	81
PID 3200 wrote to memory of 4408	3200	Velocity.exe	82
PID 3696 wrote to memory of 5080	3696	xwormm.exe	83
PID 3200 wrote to memory of 4372	3200	Velocity.exe	86
PID 4372 wrote to memory of 5012	4372	Velocity.exe	87
PID 4372 wrote to memory of 1672	4372	Velocity.exe	88
PID 1672 wrote to memory of 232	1672	Velocity.exe	92
PID 3696 wrote to memory of 4112	3696	xwormm.exe	93
PID 1672 wrote to memory of 564	1672	Velocity.exe	95
PID 564 wrote to memory of 3204	564	Velocity.exe	96
PID 564 wrote to memory of 836	564	Velocity.exe	97
PID 836 wrote to memory of 580	836	Velocity.exe	98
PID 3696 wrote to memory of 4136	3696	xwormm.exe	99
PID 836 wrote to memory of 4024	836	Velocity.exe	101
PID 4024 wrote to memory of 4428	4024	Velocity.exe	104
PID 4024 wrote to memory of 3184	4024	Velocity.exe	105
PID 3184 wrote to memory of 3900	3184	Velocity.exe	106
PID 3184 wrote to memory of 1828	3184	Velocity.exe	107
PID 1828 wrote to memory of 1424	1828	Velocity.exe	111
PID 1828 wrote to memory of 2416	1828	Velocity.exe	113
PID 2416 wrote to memory of 3164	2416	Velocity.exe	216
PID 2416 wrote to memory of 4188	2416	Velocity.exe	115
PID 4188 wrote to memory of 4772	4188	Velocity.exe	116
PID 4188 wrote to memory of 3648	4188	Velocity.exe	117
PID 3648 wrote to memory of 3408	3648	Velocity.exe	118
PID 3648 wrote to memory of 4528	3648	Velocity.exe	121
PID 4528 wrote to memory of 2192	4528	Velocity.exe	122
PID 4528 wrote to memory of 3308	4528	Velocity.exe	125
PID 3308 wrote to memory of 2720	3308	Velocity.exe	127
PID 3308 wrote to memory of 1256	3308	Velocity.exe	129
PID 1256 wrote to memory of 2704	1256	Velocity.exe	200
PID 1256 wrote to memory of 4684	1256	Velocity.exe	133
PID 4684 wrote to memory of 2648	4684	Velocity.exe	136
PID 4684 wrote to memory of 5000	4684	Velocity.exe	137
PID 5000 wrote to memory of 4552	5000	Velocity.exe	138
PID 5000 wrote to memory of 3904	5000	Velocity.exe	141
PID 3904 wrote to memory of 4792	3904	Velocity.exe	183
PID 3904 wrote to memory of 4812	3904	Velocity.exe	143
PID 4812 wrote to memory of 3740	4812	Velocity.exe	146
PID 4812 wrote to memory of 3980	4812	Velocity.exe	147
PID 3980 wrote to memory of 2644	3980	Velocity.exe	150
PID 3980 wrote to memory of 920	3980	Velocity.exe	151
PID 920 wrote to memory of 4800	920	Velocity.exe	152
PID 920 wrote to memory of 3220	920	Velocity.exe	153
PID 3220 wrote to memory of 2700	3220	Velocity.exe	156
PID 3220 wrote to memory of 828	3220	Velocity.exe	157
PID 828 wrote to memory of 3240	828	Velocity.exe	158
PID 828 wrote to memory of 2356	828	Velocity.exe	161
PID 2356 wrote to memory of 1952	2356	Velocity.exe	262
PID 2356 wrote to memory of 4068	2356	Velocity.exe	165
PID 4068 wrote to memory of 1684	4068	Velocity.exe	166
PID 4068 wrote to memory of 2792	4068	Velocity.exe	167
PID 2792 wrote to memory of 4972	2792	Velocity.exe	238
PID 2792 wrote to memory of 1880	2792	Velocity.exe	171
PID 1880 wrote to memory of 1236	1880	Velocity.exe	172
PID 1880 wrote to memory of 4748	1880	Velocity.exe	173
PID 4748 wrote to memory of 2688	4748	Velocity.exe	176
PID 4748 wrote to memory of 4888	4748	Velocity.exe	179
PID 4888 wrote to memory of 4532	4888	Velocity.exe	180
PID 4888 wrote to memory of 4792	4888	Velocity.exe	183
PID 4792 wrote to memory of 3732	4792	Velocity.exe	279
PID 4792 wrote to memory of 2348	4792	Velocity.exe	185
PID 2348 wrote to memory of 4504	2348	Velocity.exe	186

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Roaming\Velocity.exe
  "C:\Users\Admin\AppData\Roaming\Velocity.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Users\Admin\AppData\Roaming\qweqew214.exe
    "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Users\Admin\AppData\Roaming\Velocity.exe
    "C:\Users\Admin\AppData\Roaming\Velocity.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Users\Admin\AppData\Roaming\qweqew214.exe
      "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5012
  - - C:\Users\Admin\AppData\Roaming\Velocity.exe
      "C:\Users\Admin\AppData\Roaming\Velocity.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:232
    - - C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:564
      - C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3204
      - C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1424
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4552
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3740
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4504 -s 1680
        33⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        32⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4480
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        33⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        34⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        34⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4104
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        35⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        36⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        36⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        37⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        38⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        38⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        39⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        39⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        40⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:356
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        40⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        41⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        42⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        42⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        43⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        44⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        44⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        45⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        46⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        46⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        47⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        48⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        48⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3292
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        49⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        50⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        50⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        51⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        52⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        52⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        53⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        54⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        54⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        55⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        56⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        56⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        57⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        58⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        58⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        59⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        60⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        60⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        61⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        62⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        62⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        63⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        63⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        64⤵
        
        PID:72
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        64⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        65⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        65⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        66⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        66⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        67⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        67⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        68⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        68⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        69⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        69⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        70⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        70⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        71⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        71⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        72⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        72⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        73⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        73⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        74⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        74⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        75⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        75⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        76⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        76⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        77⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        77⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        78⤵
        
        PID:3772
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3772 -s 1668
        79⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        78⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        79⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        79⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        80⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        80⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        81⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        81⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        82⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        82⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        83⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        83⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        84⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        84⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        85⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        85⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        86⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        86⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        87⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        87⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        88⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        88⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        89⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        89⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        90⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        90⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        91⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        91⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        92⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        92⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        93⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        93⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        94⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        94⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        95⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        95⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        96⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        96⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        97⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        97⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        98⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        98⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        99⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        99⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        100⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        100⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        101⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        101⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        102⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        102⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        103⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        103⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        104⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        104⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        105⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        105⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        106⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        106⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        107⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        107⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        108⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        108⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        109⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        109⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        110⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        110⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        111⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        111⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        112⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        112⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        113⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        113⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        114⤵
        
        PID:2092
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2092 -s 1676
        115⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        114⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        115⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        115⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        116⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        116⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        117⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        117⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        118⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        118⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        119⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        119⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        120⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        120⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        121⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        121⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        122⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        122⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        123⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        123⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        124⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        124⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        125⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        125⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        126⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        126⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        127⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        127⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        128⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        128⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        129⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        129⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        130⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        130⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        131⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        131⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        132⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        132⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        133⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        133⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        134⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        134⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        135⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        135⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        136⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        136⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        137⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        137⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        138⤵
        
        PID:5104
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5104 -s 1656
        139⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        138⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        139⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        139⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        140⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        140⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        141⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        141⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        142⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        142⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        143⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        143⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        144⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        144⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        145⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        145⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        146⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        146⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        147⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        147⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        148⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        148⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        149⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        149⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        150⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        150⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        151⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        151⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        152⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        152⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        153⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        153⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        154⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        154⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        155⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        155⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        156⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        156⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        157⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        157⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        158⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        158⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        159⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        159⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        160⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        160⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        161⤵
        
        PID:2932
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2932 -s 1660
        162⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        161⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        162⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        162⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        163⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        163⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        164⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        164⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        165⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        165⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        166⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        166⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        167⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        167⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        168⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        168⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        169⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        169⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        170⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        170⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        171⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        171⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        172⤵
        
        PID:72
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        172⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        173⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        173⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        174⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        174⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Roaming\qweqew214.exe
        
        "C:\Users\Admin\AppData\Roaming\qweqew214.exe"
        175⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Roaming\Velocity.exe
        
        "C:\Users\Admin\AppData\Roaming\Velocity.exe"
        175⤵
        
        PID:1900
- C:\Users\Admin\AppData\Roaming\xwormm.exe
  "C:\Users\Admin\AppData\Roaming\xwormm.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\xwormm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'xwormm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\xwormm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4136

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 904 -ip 904
1⤵
PID:3164

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 3684 -ip 3684
1⤵
PID:4972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 3292 -ip 3292
1⤵
PID:1952

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 2156 -ip 2156
1⤵
PID:4104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 2596 -ip 2596
1⤵
PID:3732

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 644 -p 996 -ip 996
1⤵
PID:3684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 788 -ip 788
1⤵
PID:924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 1624 -ip 1624
1⤵
PID:4236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 1944 -ip 1944
1⤵
PID:4980

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 2876 -ip 2876
1⤵
PID:328

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 592 -p 4476 -ip 4476
1⤵
PID:4104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 664 -p 2380 -ip 2380
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Velocity.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Velocity.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 106842d701d870d9c26603db1485d0545d9e1637d907dba4cbfc5a3f53b1ea71
MD5 c8bf3de608b2222315f47b4d4eaec94d
SHA1 e0ac322cf7d9344a8d2c06e77e5aa5ff72d9be95
SHA512 43879ad973c5fd6882a81fa0f917b7b224f022ebe37f1c97c6564dcf56ac1eb748606149c18e6fce42322c7a246a62fdb36c1134efb29f81a3594d0946d05b16
TLSH
T164218933B79CC134C8D9117A208DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ad4zfywi.chd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ad4zfywi.chd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Velocity.exe

Path C:\Users\Admin\AppData\Roaming\Velocity.exe
Size 33.0MB
SHA256 224e32fc153fd0788e16e516a54b3690c894c937d412558a2610bce7777f3d9a
MD5 0e235e5098db8c6b56c2a3130a029c60
SHA1 eaae3742f4c0792a48133f442f82f2910113379b
SHA512 595f30c1d314c059c8fe050c9127e874b49e6b5ed21b24e8e81c41765c4cd773d3d1baecd06e327c7b59a9d7aa11043385a72e18f91356ae2397e68c50aff51d
SSDEEP 393216:oTT0R9Q3o2Phf/ySFJxSwqkx6dT3es/JQcAn4hQymbG5PLJ/+3fMD8J3sU1DlCx:sT0R23f/y0xwZ7eT0mC5Pg3Y8eU1g
TLSH
T14777239A57CBB8B9CF8FEFB1CC4A571706A97666AB240CC59FF5C080A4343591F2A704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qweqew214.exe

Path C:\Users\Admin\AppData\Roaming\qweqew214.exe
Size 81KB
SHA256 5f8a3f619b5addfa70cba5285d4d35ebdaba728a03e105fdf1350010110bc933
MD5 5c1353df82b9d2da877b4a6701fcda64
SHA1 4ada08bbb665cac55d3aa6ff7572e8725c57feb2
SHA512 dd76514a26828fedf3ccb578e3dfb40f4e2e984600bbf3da4454c4a1f1a7f551fe2d77e367a78d2f6fb024e793ca7304c6fe1cb41a9456b41cdaca66c4ddb70c
SSDEEP 1536:YfpEXrHbnh2dox/nPOz4dbeCr2FSu0A0BOjHiO6EDUyeJcoMBc:qCTF2enPOzsbeCrRN5BO+O6EHU1Mc
TLSH
T1AA838E2837E64129F0FFAFB09ED47562D63AF6636903965F31C5024B1523E89CE806F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xwormm.exe

Path C:\Users\Admin\AppData\Roaming\xwormm.exe
Size 58KB
SHA256 c35e782bd75b610002493dff861cb509ab1ce1c7a22f1da145d3fff73723000c
MD5 e41d56ed3b9c3693f5ea19a11a035261
SHA1 532dedbef2d0417a17708dac311dd1f3325e807a
SHA512 a138bdc0e3c2bd4562c0450970a0a8d8921fb3da80886af5242c0e8d5c70f74122cd05a38b8fac2fc533c169a650164d0ebe2f9c46cd07726cf06ce5e520d4a2
SSDEEP 1536:ZP1MR4WIKHayFPG/QXODcmvMZbQlzBCLO6PTOYcs6SX:ZqR4WbNFPGoXBmUZbQ2LvTOrsPX
TLSH
T184435C1C7BE54626E1FF6FB11DA27265D739F21348039B5F688A01D62723AC8C9413EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-123-0x0000000002610000-0x000000000261C000-memory.dmp

Download

memory/564-97-0x000000001D3A0000-0x000000001D476000-memory.dmp

Download

memory/564-96-0x00000000046F0000-0x00000000046FC000-memory.dmp

Download

memory/580-144-0x000000001AD50000-0x000000001AE26000-memory.dmp

Download

memory/580-143-0x0000000000830000-0x000000000083C000-memory.dmp

Download

memory/836-110-0x0000000004560000-0x0000000004636000-memory.dmp

Download

memory/836-109-0x0000000002CC0000-0x0000000002CCC000-memory.dmp

Download

memory/1256-181-0x000000001DBA0000-0x000000001DC76000-memory.dmp

Download

memory/1256-180-0x0000000003750000-0x000000000375C000-memory.dmp

Download

memory/1424-160-0x0000000002D50000-0x0000000002D5C000-memory.dmp

Download

memory/1424-161-0x000000001BA10000-0x000000001BAE6000-memory.dmp

Download

memory/1672-80-0x000000001D3C0000-0x000000001D496000-memory.dmp

Download

memory/1672-79-0x0000000004800000-0x000000000480C000-memory.dmp

Download

memory/1744-25-0x000000001D5E0000-0x000000001D6B6000-memory.dmp

Download

memory/1744-0-0x0000000000770000-0x000000000289E000-memory.dmp

Download

memory/1744-24-0x0000000004960000-0x000000000496C000-memory.dmp

Download

memory/1828-147-0x000000001CDE0000-0x000000001CEB6000-memory.dmp

Download

memory/1828-146-0x00000000041A0000-0x00000000041AC000-memory.dmp

Download

memory/2192-183-0x0000000002ED0000-0x0000000002EDC000-memory.dmp

Download

memory/2192-184-0x0000000002F90000-0x0000000003066000-memory.dmp

Download

memory/2416-150-0x0000000002AB0000-0x0000000002ABC000-memory.dmp

Download

memory/2416-151-0x000000001CF40000-0x000000001D016000-memory.dmp

Download

memory/2720-185-0x0000000001460000-0x000000000146C000-memory.dmp

Download

memory/3164-166-0x0000000000FF0000-0x0000000000FFC000-memory.dmp

Download

memory/3164-167-0x00000000028D0000-0x00000000029A6000-memory.dmp

Download

memory/3184-135-0x000000001D370000-0x000000001D446000-memory.dmp

Download

memory/3184-134-0x0000000002FC0000-0x0000000002FCC000-memory.dmp

Download

memory/3200-48-0x0000000002D30000-0x0000000002D3C000-memory.dmp

Download

memory/3200-49-0x000000001D110000-0x000000001D1E6000-memory.dmp

Download

memory/3200-27-0x0000000000410000-0x000000000251A000-memory.dmp

Download

memory/3204-136-0x0000000001740000-0x000000000174C000-memory.dmp

Download

memory/3204-137-0x000000001BC50000-0x000000001BD26000-memory.dmp

Download

memory/3308-172-0x0000000004CD0000-0x0000000004CDC000-memory.dmp

Download

memory/3308-173-0x000000001D830000-0x000000001D906000-memory.dmp

Download

memory/3408-177-0x000000001B8B0000-0x000000001B986000-memory.dmp

Download

memory/3408-176-0x0000000001480000-0x000000000148C000-memory.dmp

Download

memory/3648-159-0x000000001DB40000-0x000000001DC16000-memory.dmp

Download

memory/3648-158-0x0000000003700000-0x000000000370C000-memory.dmp

Download

memory/3696-26-0x00000000009B0000-0x00000000009C4000-memory.dmp

Download

memory/3696-139-0x000000001B600000-0x000000001B6D6000-memory.dmp

Download

memory/3696-138-0x00000000010D0000-0x00000000010DC000-memory.dmp

Download

memory/3900-141-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

Download

memory/4024-125-0x0000000003800000-0x000000000380C000-memory.dmp

Download

memory/4024-126-0x000000001DA90000-0x000000001DB66000-memory.dmp

Download

memory/4112-101-0x000001F048B30000-0x000001F048B42000-memory.dmp

Download

memory/4112-100-0x000001F047150000-0x000001F04715C000-memory.dmp

Download

memory/4136-130-0x0000019662570000-0x000001966257C000-memory.dmp

Download

memory/4136-131-0x0000019663FD0000-0x0000019663FE2000-memory.dmp

Download

memory/4136-118-0x000001967C780000-0x000001967C833000-memory.dmp

Download

memory/4188-155-0x000000001D760000-0x000000001D836000-memory.dmp

Download

memory/4188-154-0x00000000030F0000-0x00000000030FC000-memory.dmp

Download

memory/4372-63-0x00000000031E0000-0x00000000031EC000-memory.dmp

Download

memory/4372-64-0x0000000004AB0000-0x0000000004B86000-memory.dmp

Download

memory/4408-39-0x00000000006E0000-0x00000000006FA000-memory.dmp

Download

memory/4408-75-0x00000000026C0000-0x00000000026CC000-memory.dmp

Download

memory/4408-76-0x000000001B140000-0x000000001B216000-memory.dmp

Download

memory/4428-140-0x0000000002020000-0x000000000202C000-memory.dmp

Download

memory/4528-165-0x000000001D270000-0x000000001D346000-memory.dmp

Download

memory/4528-164-0x00000000045C0000-0x00000000045CC000-memory.dmp

Download

memory/4684-187-0x0000000004CF0000-0x0000000004CFC000-memory.dmp

Download

memory/4684-188-0x000000001D810000-0x000000001D8E6000-memory.dmp

Download

memory/4772-169-0x0000000001110000-0x000000000111C000-memory.dmp

Download

memory/4772-170-0x000000001B640000-0x000000001B716000-memory.dmp

Download

memory/5000-192-0x000000001D0C0000-0x000000001D196000-memory.dmp

Download

memory/5000-191-0x0000000002D10000-0x0000000002D1C000-memory.dmp

Download

memory/5012-121-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Download

memory/5012-122-0x00000000027E0000-0x00000000028B6000-memory.dmp

Download

memory/5080-73-0x0000029692290000-0x000002969229C000-memory.dmp

Download

memory/5080-74-0x0000029692340000-0x0000029692352000-memory.dmp

Download

memory/5080-69-0x00000296AAB70000-0x00000296AAB7A000-memory.dmp

Download

memory/5080-68-0x00000296AAB60000-0x00000296AAB66000-memory.dmp

Download

memory/5080-67-0x00000296AAB30000-0x00000296AAB38000-memory.dmp

Download

memory/5080-66-0x00000296AAB80000-0x00000296AAB9A000-memory.dmp

Download

memory/5080-65-0x00000296AAB20000-0x00000296AAB2A000-memory.dmp

Download

memory/5080-61-0x00000296AAB40000-0x00000296AAB5C000-memory.dmp

Download

memory/5080-60-0x00000296AAB10000-0x00000296AAB1A000-memory.dmp

Download

memory/5080-58-0x00000296AAA50000-0x00000296AAB03000-memory.dmp

Download

memory/5080-57-0x00000296AAA30000-0x00000296AAA4C000-memory.dmp

Download

memory/5080-43-0x00000296AA990000-0x00000296AA9B2000-memory.dmp

Download