9170d780b408f83d9fd7354078e2d827c5efdfbd426d1324c25951db13cdd93b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
Size 2.4MB
Sample260630-e9jp8aex3s
SHA256 9170d780b408f83d9fd7354078e2d827c5efdfbd426d1324c25951db13cdd93b
MD5 b466acb84ba04c298f641a94ae6ba57b
SHA1 9392400813ef4181ad489dace991b38eccd852bc
SHA512 3bb7e0753ac30af6f00bd53718ac0a0feb027323a5e5d54533dad11e834e463b93dcd980c77a88de8f098d01e50f620f0b9e1629e42d66c899ff921fb07b06fa
SSDEEP 49152:q8f2HYF/A0AxnCZ5OTexHlPRhOH2wPR+568TjFJspDLoVMgdkc:Z6mKtCPz5YH2wJ+56SFJspDLOMgdV
TLSH
T1E9C522861762C661F25FC17267E01F30B973B921A377CECA3E0491B40BF3D6AD6A1199
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	@AE4A62.tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WdExt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	module_launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	kb50145.exe

Executes dropped EXE 64 IoCs

pid	Process
2396	@AE4A62.tmp.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4512	CF9446.EXE
1660	CF9446.EXE
2228	CF9446.EXE
1720	CF9446.EXE
3904	CF9446.EXE
3580	CF9446.EXE
1776	CF9446.EXE
4724	WdExt.exe
3164	CF9446.EXE
4676	CF9446.EXE
760	CF9446.EXE
3664	CF9446.EXE
3380	CF9446.EXE
8	CF9446.EXE
3932	CF9446.EXE
3300	CF9446.EXE
4212	CF9446.EXE
1700	CF9446.EXE
3960	CF9446.EXE
3424	CF9446.EXE
2908	module_launcher.exe
2700	CF9446.EXE
624	CF9446.EXE
1972	kb50145.exe
2012	CF9446.EXE
3860	injector_s.exe
2008	CF9446.EXE
2796	module_launcher.exe
1824	CF9446.EXE
3756	CF9446.EXE
1556	CF9446.EXE
4364	CF9446.EXE
1096	CF9446.EXE
4408	CF9446.EXE
3956	CF9446.EXE
4388	CF9446.EXE
808	CF9446.EXE
1092	CF9446.EXE
1492	CF9446.EXE
2720	CF9446.EXE
3892	CF9446.EXE
4168	CF9446.EXE
1216	CF9446.EXE
1816	CF9446.EXE
2764	CF9446.EXE
2256	CF9446.EXE
1844	CF9446.EXE
2796	CF9446.EXE
3356	CF9446.EXE
4000	CF9446.EXE
1724	CF9446.EXE
1612	CF9446.EXE
5052	CF9446.EXE
5092	CF9446.EXE
3288	CF9446.EXE
4236	CF9446.EXE
4880	CF9446.EXE
728	CF9446.EXE
4980	CF9446.EXE
2860	CF9446.EXE
1080	CF9446.EXE
4828	CF9446.EXE

Loads dropped DLL 64 IoCs

pid	Process
2396	@AE4A62.tmp.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Admin\\module_launcher.exe\""	module_launcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\665798\CF9446.EXE	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF9446.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2396	@AE4A62.tmp.exe
2396	@AE4A62.tmp.exe
4724	WdExt.exe
4724	WdExt.exe
2908	module_launcher.exe
2908	module_launcher.exe
2908	module_launcher.exe
2908	module_launcher.exe
2908	module_launcher.exe
2908	module_launcher.exe
2908	module_launcher.exe
2908	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
2796	module_launcher.exe
3860	injector_s.exe
3860	injector_s.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	injector_s.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
4512	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
1660	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
2228	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
1720	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3904	CF9446.EXE
3580	CF9446.EXE
3580	CF9446.EXE
3580	CF9446.EXE
3580	CF9446.EXE
3580	CF9446.EXE
3580	CF9446.EXE
3580	CF9446.EXE
1776	CF9446.EXE
1776	CF9446.EXE
1776	CF9446.EXE
1776	CF9446.EXE
1776	CF9446.EXE
1776	CF9446.EXE
1776	CF9446.EXE
3164	CF9446.EXE
3164	CF9446.EXE
3164	CF9446.EXE
3164	CF9446.EXE
3164	CF9446.EXE
3164	CF9446.EXE
3164	CF9446.EXE
4676	CF9446.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 940	4652	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe	84
PID 4652 wrote to memory of 940	4652	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe	84
PID 4652 wrote to memory of 940	4652	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe	84
PID 940 wrote to memory of 2396	940	explorer.exe	85
PID 940 wrote to memory of 4412	940	explorer.exe	86
PID 2396 wrote to memory of 5000	2396	@AE4A62.tmp.exe	87
PID 2396 wrote to memory of 1952	2396	@AE4A62.tmp.exe	89
PID 4412 wrote to memory of 4512	4412	2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe	90
PID 4512 wrote to memory of 1660	4512	CF9446.EXE	92
PID 1660 wrote to memory of 2228	1660	CF9446.EXE	93
PID 2228 wrote to memory of 1720	2228	CF9446.EXE	94
PID 1720 wrote to memory of 3904	1720	CF9446.EXE	95
PID 3904 wrote to memory of 3580	3904	CF9446.EXE	96
PID 3580 wrote to memory of 1776	3580	CF9446.EXE	97
PID 5000 wrote to memory of 4724	5000	cmd.exe	98
PID 1776 wrote to memory of 3164	1776	CF9446.EXE	99
PID 4724 wrote to memory of 876	4724	WdExt.exe	100
PID 3164 wrote to memory of 4676	3164	CF9446.EXE	101
PID 4676 wrote to memory of 760	4676	CF9446.EXE	103
PID 760 wrote to memory of 3664	760	CF9446.EXE	104
PID 3664 wrote to memory of 3380	3664	CF9446.EXE	105
PID 3380 wrote to memory of 8	3380	CF9446.EXE	106
PID 8 wrote to memory of 3932	8	CF9446.EXE	107
PID 3932 wrote to memory of 3300	3932	CF9446.EXE	108
PID 3300 wrote to memory of 4212	3300	CF9446.EXE	109
PID 4212 wrote to memory of 1700	4212	CF9446.EXE	110
PID 1700 wrote to memory of 3960	1700	CF9446.EXE	111
PID 3960 wrote to memory of 3424	3960	CF9446.EXE	112
PID 876 wrote to memory of 2908	876	cmd.exe	113
PID 3424 wrote to memory of 2700	3424	CF9446.EXE	114
PID 2908 wrote to memory of 1304	2908	module_launcher.exe	115
PID 2700 wrote to memory of 624	2700	CF9446.EXE	116
PID 1304 wrote to memory of 1972	1304	cmd.exe	118
PID 624 wrote to memory of 2012	624	CF9446.EXE	119
PID 1972 wrote to memory of 3860	1972	kb50145.exe	120
PID 1972 wrote to memory of 4000	1972	kb50145.exe	151
PID 2012 wrote to memory of 2008	2012	CF9446.EXE	124
PID 2008 wrote to memory of 1824	2008	CF9446.EXE	126
PID 1824 wrote to memory of 3756	1824	CF9446.EXE	127
PID 3756 wrote to memory of 1556	3756	CF9446.EXE	128
PID 1556 wrote to memory of 4364	1556	CF9446.EXE	129
PID 4364 wrote to memory of 1096	4364	CF9446.EXE	130
PID 1096 wrote to memory of 4408	1096	CF9446.EXE	132
PID 4408 wrote to memory of 3956	4408	CF9446.EXE	133
PID 3956 wrote to memory of 4388	3956	CF9446.EXE	135
PID 4388 wrote to memory of 808	4388	CF9446.EXE	136
PID 808 wrote to memory of 1092	808	CF9446.EXE	138
PID 1092 wrote to memory of 1492	1092	CF9446.EXE	139
PID 1492 wrote to memory of 2720	1492	CF9446.EXE	140
PID 2720 wrote to memory of 3892	2720	CF9446.EXE	142
PID 3892 wrote to memory of 4168	3892	CF9446.EXE	143
PID 4168 wrote to memory of 1216	4168	CF9446.EXE	144
PID 1216 wrote to memory of 1816	1216	CF9446.EXE	145
PID 1816 wrote to memory of 2764	1816	CF9446.EXE	146
PID 2764 wrote to memory of 2256	2764	CF9446.EXE	147
PID 2256 wrote to memory of 1844	2256	CF9446.EXE	148
PID 1844 wrote to memory of 2796	1844	CF9446.EXE	149
PID 2796 wrote to memory of 3356	2796	CF9446.EXE	150
PID 3356 wrote to memory of 4000	3356	CF9446.EXE	151
PID 4000 wrote to memory of 1724	4000	CF9446.EXE	152
PID 1724 wrote to memory of 1612	1724	CF9446.EXE	153
PID 1612 wrote to memory of 5052	1612	CF9446.EXE	154
PID 5052 wrote to memory of 5092	5052	CF9446.EXE	155
PID 5092 wrote to memory of 3288	5092	CF9446.EXE	156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3172
- C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Users\Admin\AppData\Local\Temp\@AE4A62.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\@AE4A62.tmp.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5000
      - C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
        
        "C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
        
        "C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 4724
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
        
        "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Users\Admin\AppData\Roaming\injector_s.exe
        
        "C:\Users\Admin\AppData\Roaming\injector_s.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""
        11⤵
        
        PID:4000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4512
      - C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        10⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        11⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        12⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3164
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        13⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        55⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        56⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        57⤵
        Executes dropped EXE
        
        PID:728
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        58⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        59⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        60⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        61⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        62⤵
        
        PID:752
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        63⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        64⤵
        
        PID:916
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        65⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        66⤵
        
        PID:328
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        67⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        70⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        71⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        72⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        73⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        74⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        75⤵
        
        PID:816
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        76⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:3184
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        80⤵
        
        PID:884
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        81⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        82⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        83⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        85⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        86⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        87⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        88⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        89⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        90⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        91⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        92⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        93⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        94⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:1176
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        96⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        97⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        98⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        99⤵
        
        PID:416
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        100⤵
        
        PID:612
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        101⤵
        
        PID:928
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        102⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        103⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        104⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        105⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        106⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        107⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        108⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        109⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        110⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        111⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        112⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        113⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        114⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        115⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        116⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        117⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        118⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        119⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        120⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        121⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        122⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        123⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        124⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        125⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        126⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        128⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        129⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        130⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        131⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        132⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        133⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        134⤵
        
        PID:860
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        135⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        137⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        138⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        139⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        140⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        142⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        143⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        144⤵
        
        PID:316
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        145⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        146⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        147⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        148⤵
        
        PID:388
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        149⤵
        
        PID:516
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        150⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        151⤵
        
        PID:548
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        152⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        153⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        154⤵
        
        PID:452
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        155⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        157⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        158⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        159⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        160⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        161⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        162⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:1768
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        164⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        165⤵
        
        PID:216
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        166⤵
        
        PID:812
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        167⤵
        
        PID:880
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        168⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        169⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        170⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        171⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        172⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        173⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        174⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        175⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        177⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        178⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        179⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        180⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        181⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        182⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        183⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        184⤵
        
        PID:116
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        185⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        186⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        187⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        188⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        189⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        190⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        191⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        192⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        193⤵
        
        PID:32
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        194⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        195⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        196⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        197⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        198⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        200⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        201⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        202⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        203⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        204⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        205⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        206⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        207⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        208⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        209⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        210⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        211⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        212⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        213⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        214⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        215⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        216⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        217⤵
        
        PID:212
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:764
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        219⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        220⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        222⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        223⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        224⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        225⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        226⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        227⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        228⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        230⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        231⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        232⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        234⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        235⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        236⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        237⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        238⤵
        
        PID:532
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        239⤵
        
        PID:468
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        240⤵
        
        PID:964
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        241⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        242⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        243⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        244⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        245⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        246⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        247⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        248⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        249⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        250⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        251⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        252⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        253⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        254⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        255⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        256⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        257⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        258⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        259⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        260⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        262⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        263⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        264⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        265⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        266⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        267⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        268⤵
        
        PID:64
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        269⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        270⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        271⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        272⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        273⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        274⤵
        
        PID:732
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        275⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        276⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        277⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        278⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        279⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        280⤵
        
        PID:984
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        281⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        282⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        283⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        284⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        285⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        286⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        287⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        288⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        289⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        290⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        291⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        292⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        293⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        294⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        295⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        296⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        297⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        298⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        299⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        300⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        301⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        303⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        304⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        305⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        306⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        307⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        308⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        309⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        310⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        311⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        312⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        313⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        314⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        315⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        316⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        317⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        318⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        319⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        320⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        321⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        322⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        324⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        325⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        326⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        327⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        329⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        330⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        331⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        332⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        334⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        335⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        336⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        337⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        338⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        339⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        340⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        341⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        343⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        344⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        345⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        346⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        347⤵
        
        PID:980
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        348⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        349⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        350⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        351⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        352⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        353⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        354⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        355⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        356⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        357⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        358⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        359⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        360⤵
        
        PID:712
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        361⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        362⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        363⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        364⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        365⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        366⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        368⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        369⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        370⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        371⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        372⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        373⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        374⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        375⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        376⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        378⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        379⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        380⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        381⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        382⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        383⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        384⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        385⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        387⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        388⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        389⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        390⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        391⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        393⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        394⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        395⤵
        
        PID:804
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        397⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        398⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        399⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        400⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        401⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        404⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        405⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        407⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        408⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        409⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        410⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        411⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        412⤵
        
        PID:748
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        413⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        414⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        415⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        416⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        417⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        418⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        419⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        420⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        421⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        422⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        423⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        424⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        425⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        426⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        427⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        428⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        429⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        431⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        432⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        433⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        434⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        435⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        436⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        437⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        438⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        439⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        440⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        441⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        442⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        443⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        444⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        445⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        446⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        447⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        448⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        450⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        451⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        452⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        453⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        454⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        455⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        456⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        457⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        458⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        459⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        462⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        463⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        464⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        465⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        466⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        467⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        468⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        469⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        470⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        471⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        472⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        473⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        474⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        475⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        477⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        478⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        479⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        480⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        481⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        482⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        483⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        484⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        485⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        486⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        487⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        488⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        489⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        490⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        491⤵
        
        PID:380
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        492⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        493⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        494⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        495⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        496⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        497⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        498⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        499⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        500⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        501⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        502⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        503⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        504⤵
        
        PID:864
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        505⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        506⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        507⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        508⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        509⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        510⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        511⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        512⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        513⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        514⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        515⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        516⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        517⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        518⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        519⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        520⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        521⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        522⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        523⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        524⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        525⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        526⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        527⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        528⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        529⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        530⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        531⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        532⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        533⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        534⤵
        
        PID:768
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        535⤵
        
        PID:640
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        536⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        537⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        538⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        539⤵
        
        PID:932
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        540⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        541⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        542⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        543⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        544⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        545⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        546⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        547⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        548⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        549⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        550⤵
        
        PID:540
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        551⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        552⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        553⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        554⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        555⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        556⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        557⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        558⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        559⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        560⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        561⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        562⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        563⤵
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        564⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        565⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        566⤵
        System Location Discovery: System Language Discovery
        
        PID:176
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        568⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        569⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        570⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        571⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        572⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        573⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        574⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        575⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        576⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        577⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        578⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        579⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        580⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        581⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        582⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        583⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        584⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        585⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        586⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        587⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        588⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        589⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        590⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        591⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        592⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        593⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        594⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        595⤵
        
        PID:556
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        596⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        597⤵
        
        PID:684
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        598⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        599⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        600⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        601⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        602⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        603⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        604⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        605⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        606⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        607⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        608⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        609⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        610⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        611⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        612⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        613⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        614⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        615⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        616⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        617⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        618⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        619⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        620⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        621⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        622⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        623⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        624⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        625⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        626⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        627⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        628⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        629⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        630⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        631⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        632⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        633⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        634⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        635⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        636⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        637⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        638⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        639⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        640⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        641⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        642⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        643⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        644⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        645⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        646⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        647⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        648⤵
        System Location Discovery: System Language Discovery
        
        PID:6652
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        649⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        650⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        651⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        652⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        653⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        654⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        655⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        656⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        657⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        658⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        659⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        660⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        661⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        662⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        663⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\665798\CF9446.EXE
        
        C:\Windows\system32\665798\CF9446.EXE
        664⤵
        
        PID:6384

C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
"C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-29_b466acb84ba04c298f641a94ae6ba57b_coinminer_elex_nymaim_rhadamanthys_wannacry.exe
Size 1.5MB
SHA256 8a3d0b24007dbf44415e89b88f6f495c08f49958794cb66ee87589f4bd3f285d
MD5 0a594fe7273f156da10d510dc62930b9
SHA1 c19a82c986bdac1686b7169475a660d303799c4b
SHA512 46ab469db933a9afb5cf4597d18f46e3318a7aae32ec84e46eef2bfbb405952587926285fcc8d76fa44675c71b55eed2db3adde93be08e6e731e5395c99f6dd1
SSDEEP 24576:6dMdf2I9+YmoVqEKswy+QA0/IxnCgExt5/GT1Ix+gtHlPRMkb2JH2Q9tPR+UZyCn:68f2HYF/A0AxnCZ5OTexHlPRhOH2wPRJ
TLSH
T1B87522C206372345F654AA7533E90A227CA7F962D5EA9BDA3C10E0F107E3974C5B99CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@AE4A62.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\@AE4A62.tmp.exe
Size 961KB
SHA256 dcc1d47b76a697fe85bee5e79d11b75086e0cfc035572f69397d0138e4368909
MD5 0d7877a73d873c491fcfb7d005bf9f2b
SHA1 487d9bf9265a259f2f9a85d6095e7b53eb7187f5
SHA512 a2afe88ce15510bd811ac9d0b28ed97b89d9dab9481c7d6aa50cc42f2cecc7269e9b3b2e8f42599f42127c25bc9cadb13dfcdf32baa837fb12ef1288268ba91e
SSDEEP 24576:1GRzatThRiVNbLGJv6plFh9iGa2oMYMgdsHGpQ:o8TjFJspDLoVMgdkP
TLSH
T17825F1196B80CDA1F26FC07286D06F34B6772A202732CD4A6F4895391FF2E5FE792156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HtmlView.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\HtmlView.fne
Size 212KB
SHA256 d732dce44375d953baed79a9a2657aa5f906c3a45dc158f5ac7673eafaac85b1
MD5 a352f96e20cd9c12f3c8a58520be0d89
SHA1 4b6678cb069d4f1d95ed7e3ce1bff176c9bf9f09
SHA512 7fdfba674538d0deec551871591fb2270d6791a1dbf53fa2ccc076ba1da3da3a725a47144d84d62a5e285d0bc5f96c7ae07bb4f17607ebc937f25206de6ece8e
SSDEEP 6144:pdhc1M5BE9tUXkv6yspFvdrqI9fFpdul9J49hZFbR3zJBdr0Q7JkL:X5RkyyszFF9mQ7
TLSH
T1D524AE393A26EB71C65F2F7B98478ECD7521B0218FD0A187B9B89F6E08358527C4F164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegEx.fnr

Path C:\Users\Admin\AppData\Local\Temp\E_N4\RegEx.fnr
Size 212KB
SHA256 c13c575afc9cd61fa1578ce908c60d8e70675a4f3a942281d88a740d44c2fb00
MD5 f6940031aa6aa681bafaecfd5b58bf16
SHA1 5d6eeefb12a62b53a599eb5e3ec42941df57e510
SHA512 eee054d8120d26ea58536043899de40a4db08c655bc4d8626dd0386324999b93a4d37d173c84c8a47b74238386feed52f031a6f69d983ed41515e98aabab14f5
SSDEEP 3072:rd6+AUaQJJxa1y2nP2h+8JVpSZpVvjAx0PI8Unpyr+TtIWaMZx14tm0:romJDh4uh+8JeV0mwp7vaMH
TLSH
T158248D111BC18453E5590C7389C085F779AEBD4BE694208FAFCF76FAD6221E885CC9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cnvpe.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\cnvpe.fne
Size 60KB
SHA256 909a96748f43cd593a44a4554fb71c4af7583fb1a20df1cc03771d1a3f4ead1d
MD5 b45ef68191b429e4bbceca8cfdc41a4d
SHA1 b3e0aa6c0b5f5b84e1a8579e614c14d16375712f
SHA512 58d7252447b19ed96132b3e813704551989a231abc0ba14131d8e4b5f62f83814a7d8e0f93c3fb3a84d650b39ee0c8ca3bb6679a1d18c38d1b765d6c2186207b
SSDEEP 1536:4u9JLthpUqxsGwDxklM3Q7odFB8opFa4:4u9ZpUq01kGQ7ol8ob
TLSH
T1FE53BFA34BD0984BC42E4F3A9DD958BB7A10FD05D96430C60DCFB8778A9E7A094DD322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dp1.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne
Size 124KB
SHA256 72d8603a54d170e9d90d93b7af42302c8d58a4e85691e32e19687994da3f93e2
MD5 0d360dec05d6c4b5c61cb6a738bd2631
SHA1 cbd5ce627d66cc6a6f37a27a1cf64afa675d1dd0
SHA512 700e314c49489b0ffaecd7336fbfce228d9c6a1f6197a7a61a7ffe5966b6afe194c41c17f8d787f874ff5615072b009de87ec45f4d3133a054cdb86db2bbd1ed
SSDEEP 3072:pa9sZnwZcM66zlxwSJiJ1dTkQ6PIJR3951oFHYjk9Qr:paspwcJIiJs83394HYjku
TLSH
T1EDC3BF7F2EE1777BD9DA0D338CA305F44109B79186E094D3A8B16FBEA554190B60EBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eAPI.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\eAPI.fne
Size 332KB
SHA256 b78c7380d6e0e053dd06dfc0f0630591347340351e5fd7beb653061370e232b9
MD5 21918d0fb73354b42e546fcc18e881a1
SHA1 6bfc66f29fcde21e24828b54b9043e3a77474979
SHA512 97fe72f4b806ac0e904ddb659116c0f3dfe57db44022dc5ceaffd37a294aa9d76fa6e47eb01f79226644c8f1d4a710d7df89d43af08d7780b5b87d575640ee7a
SSDEEP 6144:ihvCQDgr6ftNyDmKoZkWekM5B4tnbnhsmg6UmsV137pu2kM:ihvZASyRoZR4H3djf
TLSH
T1D674AE3A3666FF76CCEF0E7B641348E45101FA828EE8E2A77DB42B9D4863651394F414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eCompress.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\eCompress.fne
Size 164KB
SHA256 b24d6894c11ae10948f2bc6140c35f496f359b7305281a73217c09c3389c0681
MD5 d32095a2c0c4f669a08efbe8e7ad8348
SHA1 9d56b8c60313f111d42f3444e3f07f7d2805857c
SHA512 cae19186478048a4bfcbe525ad041a6b528cb9604c096a8ed464031aa40c4e1e171312e4f900a68f551a8077750b5f95a7bfa5acc44721a238f5ca6e6b4c1c6f
SSDEEP 3072:lzpzWegr9p1IUl3bE+kG78nYGHBa8yoTxs:HKegr9p1IUJbvd8n/0
TLSH
T17BF3AD1223E0C8EBD0BF1A7A6CD84A6F7154FE01EB0459436ECF257EAE2A15607CD749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internet.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\internet.fne
Size 180KB
SHA256 30c51687da41be68a015001b7192d4a5111031651444fdc5ba3c1b82a02382e0
MD5 87e8e80ab672e37e07724bf801ae1686
SHA1 f40a4b665442c0f711891f92ae72d7affa9f17b6
SHA512 f5fa852257095c8945ed69c3123dfd2245614cde7ed9e4dceefdfc213ce737fd6803c949bd7673412facf0258b5ac74f26e97be2e4b427e0b1d333b71100a085
SSDEEP 3072:CHnxhKiIcrwlpkd5H116PQ+TIqTQ3SbYPV3LHFF7nLORgy6AV/d/6ok8TVz5Nebd:7ltKy/bYPV3LHFF7LORR6OHEx
TLSH
T1F504BF393A32FB75C89E6E37080389C8A351FA41CFD596E378B83B1D98626653D4D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krnln.fnr

Path C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
Size 1.1MB
SHA256 d49683227b8d1677b4aa188084fb5726326fedd2f1de415c3316c4e79c2c7cac
MD5 c483fe87278a6f3f1feec71816f37f16
SHA1 d3c94fe9d084c9a471625b4897a7538c208a5651
SHA512 618bf6e7525d28b869610890535471f14103c7c251f1ec58eee3c71c829b9fd85319c69889f636baf3e409febf70f0b03d48badd7411417f076ad02ba6cac073
SSDEEP 24576:+Mr47j/NM9SnV4GvMsvrOodJ9b4hMhth11sV7V/QF+QnT:A77NzZvvrOodJ9b4FYF+QnT
TLSH
T11635CF3EB9E8DC75D22DCB3362E08FE6A5C0C2616868F44E0F473BACD464E934559A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\shell.fne
Size 40KB
SHA256 b30b56b9c6fc95de2b6e62703bc6d97d40ab133b333ee5911317baef32e4c0ea
MD5 821381d03d162a900bebd21afb4cc534
SHA1 5c33bccbdafcc9b22b6e0be2ae2c0c14baf069c0
SHA512 221d3279d2c0b8ac5a276106d0de21bfcdaf0ae23502d847c589af82d9598227878630604c7a957ac37791f80d556b8969ca615ae3f9a2c015acfc0cc79a0c3b
SSDEEP 768:FDfiaAjhiW6tnU9S7jSM0g2h1ONUM3FjLosEnXPj5x:Ojhi4AB0n1O/xos+XX
TLSH
T14E03AE4913D49CCBE66806BC2DD49A6F7C1A3E76E3F021890CCBB0751B675B482DDB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spec.fne

Path C:\Users\Admin\AppData\Local\Temp\E_N4\spec.fne
Size 72KB
SHA256 3940ce033d5aa87608b917ae6ec388be5501da8d8924f476d70e96dcc5e49e86
MD5 9e8d11fd412bc5bbb3628c6fd36ac54d
SHA1 f5b4e485c4b4e3219a4c6e6be8ee564196a7986b
SHA512 369173f89ca351fb8420cbb818b73e4c121772d8501c1addc5ffa177ebec885fbbf5fc328ea119f9b4e8b74c33d973917942331f3e99a6fa96ab10c755234843
SSDEEP 1536:S8qJq97iT7WgLqHvpcuibX5fSKoy987duc:1WqJc7WS0KoC8
TLSH
T17473CE9223D5488BD59E037A7CE94D6F7503FF4BE220198A0C9BB0B25B4F3A645DC725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp554F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp554F.tmp
Size 619KB
SHA256 5864a4bfc200c2d9aadfa8c9540da1af036c2c712309da9d88fa901e9582b950
MD5 713537a3f79d36f0eaeaf8e8fba96322
SHA1 f03481707b940065e41ce008eda643eea78ffe40
SHA512 0bf36c904e863d79d57b83e6e54371056b2fc0ddfa89b806519fbeb91c2ac4f9688d5c7d2619a496320d28cd008313fff61f92612dfe69c00d093917366189e3
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy/:r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp555F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp555F.tmp
Size 121KB
SHA256 e1a25be30164e6aca9bf97454be217f2b49e6f65fa4d3ac710637f6ef8a213a0
MD5 864484e1394eaaa2e9a8a63f01c97be0
SHA1 d02a92d866232f22a8477ab99e6d27354fa310f2
SHA512 16919202ee3626ab829070dbe2f43bb5caa9bbaebf63f5de3fb9930825f71edd074855cac6349241705d6bf979203e0eb7f9df2c25d2bfab95ee210ac350568c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyH:L
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5570.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5570.tmp
Size 131KB
SHA256 ba6a7655e3860d01201ffbce06398dff71fd97acff99e95ac8cd2a3e3161d1c0
MD5 ebc999a1ded4f76d648431350fe423bb
SHA1 b1a4abcb00364ede9185209d41e7e2532cd559a0
SHA512 aba5a33667e01857650f74ea5dd461c11a0ff121c22e08ab058b950b11b315119b00acaf0aaf7401a668a4131daf73d07717002c6dd55570a79ad5ba526e5ce4
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyn:z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5571.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5571.tmp
Size 99KB
SHA256 4a8ea33966592b337d31802f55ea7f901caec037b5b1bf18a9e2b6b044915781
MD5 88c497ace0db30cc47fc259b7806ad8f
SHA1 a486cedff64cb60e62ffbefd25ee5df79e6a9714
SHA512 1748700a158b8f999658eb532e5d4ed80c844b21c47d3bf0d8682de22be4b47a424350196ee3d0538d71a67aca906b781282eb3192031e93e834f417b8134346
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy/:r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5572.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5572.tmp
Size 172KB
SHA256 015caba690febdd5403ad86a04bb9763db7408a3b3f0be85f9c364580dac4649
MD5 b00a14a9f3b2c8ac19ada6992517ff77
SHA1 8469aa684cf86fcf627c828d40a9dc9688187173
SHA512 fea53117dc2efc23af186fae9ea8abc6ed15a516a820d62a5d312525447b0495fc0d81acf540017422427ea45754298fb7e334c9db8c47d49c4ce741f85bbf2c
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyn:r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5583.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5583.tmp
Size 76KB
SHA256 a1d30db63fcb26cfcc1e128f4b840ac1c822267a8f17de45cc2e2fc19147e41f
MD5 ccf05ce9abe252cc7d68b2ff8ab6cfb7
SHA1 8739e9e007b62d9434bd5d06d5d312d255496a00
SHA512 e2e56fa332b895fc54fd9a6ccd71952f11237f18d66b2342a47c7b707a65743d3f8b84efa5988257e657623cb748cb196e36a8839fb1cd5f600cb30623b2a29b
SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyT:f
MD5 SHA1 SHA512 SSDEEP

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
TLSH
T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mydll.dll

Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
Size 388KB
SHA256 c91affccfd80e70bd68d898b04e594f317b70ec3ec0ef332acdafcbae5691ea2
MD5 79682586a77493bd90825e92bb704dec
SHA1 6d78e3783f900def8faeb123109419d26e0e7f74
SHA512 54193619982cff57618b11494611606d864aa63c8867c5f679b6d3d8b7b700228bdbc2e2751c1634f1841db7ab613550eacde73aa0d916f8f14da64c5f2bfa59
SSDEEP 1536:goNDuGRa2s/aov6ZIZu1X14ZvILc4AYp3K2fi89A2z6lpt:PDuGRa2YzvDZvApARC6/t
TLSH
T15E84A618DC93CA1A4F5B83D0B9AE96B3F8269F530DCEE747339C0F1EA6D65E29110509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-346-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/8-345-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/624-389-0x0000000002F00000-0x0000000002F11000-memory.dmp

Download

memory/624-409-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/624-410-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/624-386-0x0000000002310000-0x0000000002348000-memory.dmp

Download

memory/760-327-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/760-328-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1096-458-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1096-447-0x0000000002A00000-0x0000000002A62000-memory.dmp

Download

memory/1096-448-0x00000000029E0000-0x00000000029F1000-memory.dmp

Download

memory/1096-459-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1556-441-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1556-434-0x0000000002210000-0x0000000002248000-memory.dmp

Download

memory/1556-442-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1660-219-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1660-220-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1700-370-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1700-369-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1720-231-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1720-232-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1776-310-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1776-309-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1824-421-0x0000000002250000-0x0000000002288000-memory.dmp

Download

memory/1824-419-0x0000000002510000-0x0000000002521000-memory.dmp

Download

memory/1824-433-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/1824-417-0x0000000002250000-0x0000000002288000-memory.dmp

Download

memory/1824-418-0x0000000002DF0000-0x0000000002E1C000-memory.dmp

Download

memory/1824-420-0x0000000002F70000-0x0000000002FD2000-memory.dmp

Download

memory/1824-432-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2008-427-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/2008-426-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2012-415-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/2012-416-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2228-226-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/2228-225-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2396-15-0x0000000010000000-0x0000000010015000-memory.dmp

Download

memory/2700-394-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2700-395-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3164-316-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3164-315-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3300-357-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3300-358-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3380-340-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3380-339-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3424-388-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3424-387-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3580-299-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3580-300-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3664-334-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3664-333-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3756-440-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3756-439-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3904-235-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3904-234-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3932-352-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3932-351-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3956-463-0x0000000002610000-0x0000000002631000-memory.dmp

Download

memory/3956-474-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3956-475-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3960-380-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/3960-379-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4212-363-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4212-364-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4364-449-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4364-454-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4388-481-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4388-480-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4408-469-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4408-468-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4408-456-0x0000000002FD0000-0x0000000003032000-memory.dmp

Download

memory/4408-455-0x00000000024A0000-0x00000000024CC000-memory.dmp

Download

memory/4412-196-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4412-101-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4412-104-0x0000000002380000-0x00000000023B8000-memory.dmp

Download

memory/4412-197-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4412-87-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4412-122-0x00000000023C0000-0x00000000023EC000-memory.dmp

Download

memory/4412-128-0x0000000002160000-0x0000000002171000-memory.dmp

Download

memory/4412-133-0x0000000003200000-0x0000000003262000-memory.dmp

Download

memory/4412-142-0x0000000002FC0000-0x0000000002FE1000-memory.dmp

Download

memory/4512-210-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4512-211-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4676-322-0x0000000010000000-0x000000001011D000-memory.dmp

Download

memory/4676-321-0x0000000000400000-0x000000000041D000-memory.dmp

Download