Overview

overview

10

Static

static

10

2026-10-10...if.exe

windows10-2004-x64

10

2026-10-10...if.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    42s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 22:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
  • Size 523KB
  • Sample261011-2rx68ass7j
  • SHA256 52ab4cb14e7ada055bad3aeb3a9a0e946978436f6b71955931fbbca209c49fd6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryevasionexecutionfloxifpersistenceprivilege_escalationspywaretrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies firewall policy service 3 TTPs 6 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Windows security bypass 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • UPX dump on OEP (original entry point) 60 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 24 IoCs
  • Windows security modification 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • AutoIT Executable 19 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 11 IoCs
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3244
    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688
      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /TI
        3⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • Modifies Windows Defender TamperProtection settings
        • Modifies security service
        • Event Triggered Execution: Image File Execution Options Injection
        • Loads dropped DLL
        • Windows security modification
        • Enumerates connected drives
        • Indicator Removal: Clear Persistence
        • Modifies Security services
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Program Files\Windows Defender\mpcmdrun.exe
          "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
          4⤵
            PID:3512
          • C:\Windows\Explorer.exe
            "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
            4⤵
              PID:1472
            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2376
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1672
            • C:\Windows\Explorer.exe
              "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
              4⤵
                PID:6764
              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                4⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:6776
              • C:\Program Files\Windows Defender\mpcmdrun.exe
                "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                4⤵
                  PID:6784
                • C:\Windows\Explorer.exe
                  "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                  4⤵
                    PID:6912
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|6764|
                    4⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:6924
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    PID:6936
                  • C:\Windows\Explorer.exe
                    "C:\Windows\Explorer.exe" windowsdefender:
                    4⤵
                      PID:6208
                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                      4⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:6224
                    • C:\Windows\Explorer.exe
                      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                      4⤵
                        PID:6816
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                        4⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:6896
                      • C:\Program Files\Windows Defender\mpcmdrun.exe
                        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                        4⤵
                        • Drops file in Windows directory
                        PID:6920
                      • C:\Windows\Explorer.exe
                        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                        4⤵
                          PID:6856
                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|6816|
                          4⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:6944
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:6500
                        • C:\Windows\Explorer.exe
                          "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                          4⤵
                            PID:5632
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                            4⤵
                              PID:5296
                            • C:\Program Files\Windows Defender\mpcmdrun.exe
                              "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                              4⤵
                                PID:2420
                              • C:\Windows\Explorer.exe
                                "C:\Windows\Explorer.exe" windowsdefender:
                                4⤵
                                  PID:6360
                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|6956|
                                  4⤵
                                    PID:5468
                                  • C:\Windows\Explorer.exe
                                    "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                    4⤵
                                      PID:6460
                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                      4⤵
                                        PID:6964
                                      • C:\Program Files\Windows Defender\mpcmdrun.exe
                                        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                        4⤵
                                          PID:6348
                                        • C:\Windows\Explorer.exe
                                          "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                          4⤵
                                            PID:3836
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|6460|
                                            4⤵
                                              PID:6512
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                              4⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:6488
                                            • C:\Windows\Explorer.exe
                                              "C:\Windows\Explorer.exe" windowsdefender:
                                              4⤵
                                                PID:4932
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                4⤵
                                                  PID:1684
                                                • C:\Windows\Explorer.exe
                                                  "C:\Windows\Explorer.exe" windowsdefender:
                                                  4⤵
                                                    PID:5680
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|4932|2604|
                                                    4⤵
                                                      PID:4308
                                                    • C:\Windows\Explorer.exe
                                                      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                      4⤵
                                                        PID:1928
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|2604|2480|
                                                        4⤵
                                                          PID:4856
                                                        • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                          "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                          4⤵
                                                            PID:2140
                                                          • C:\Windows\Explorer.exe
                                                            "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                            4⤵
                                                              PID:3108
                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|2604|2480|1928|
                                                              4⤵
                                                                PID:4776
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                4⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:1680
                                                              • C:\Windows\Explorer.exe
                                                                "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                4⤵
                                                                  PID:4104
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                  4⤵
                                                                    PID:6988
                                                                  • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                    "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                    4⤵
                                                                      PID:7132
                                                                    • C:\Windows\Explorer.exe
                                                                      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                      4⤵
                                                                        PID:1392
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|4104|
                                                                        4⤵
                                                                          PID:5596
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                          4⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:6576
                                                                        • C:\Windows\Explorer.exe
                                                                          "C:\Windows\Explorer.exe" windowsdefender:
                                                                          4⤵
                                                                            PID:6412
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                            4⤵
                                                                              PID:4124
                                                                            • C:\Windows\Explorer.exe
                                                                              "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                              4⤵
                                                                                PID:6236
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                4⤵
                                                                                  PID:4184
                                                                                • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                  "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                  4⤵
                                                                                    PID:204
                                                                                  • C:\Windows\Explorer.exe
                                                                                    "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                                    4⤵
                                                                                      PID:1052
                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|6236|
                                                                                      4⤵
                                                                                        PID:6980
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:4816
                                                                                      • C:\Windows\Explorer.exe
                                                                                        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                                        4⤵
                                                                                          PID:6772
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                          4⤵
                                                                                            PID:1060
                                                                                          • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                            "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                            4⤵
                                                                                              PID:6548
                                                                                            • C:\Windows\Explorer.exe
                                                                                              "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                                              4⤵
                                                                                                PID:5884
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|6772|
                                                                                                4⤵
                                                                                                  PID:5932
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                                                  4⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  PID:7112
                                                                                                • C:\Windows\Explorer.exe
                                                                                                  "C:\Windows\Explorer.exe" windowsdefender:
                                                                                                  4⤵
                                                                                                    PID:6232
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                                    4⤵
                                                                                                      PID:1648
                                                                                                    • C:\Windows\Explorer.exe
                                                                                                      "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                      4⤵
                                                                                                        PID:4876
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                                        4⤵
                                                                                                          PID:6988
                                                                                                        • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                                          "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                          4⤵
                                                                                                            PID:6848
                                                                                                          • C:\Windows\Explorer.exe
                                                                                                            "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                                                            4⤵
                                                                                                              PID:4688
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|4876|
                                                                                                              4⤵
                                                                                                                PID:956
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                                                                4⤵
                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                PID:5392
                                                                                                              • C:\Windows\Explorer.exe
                                                                                                                "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                4⤵
                                                                                                                  PID:4360
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                                                  4⤵
                                                                                                                    PID:4976
                                                                                                                  • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                                                    "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                    4⤵
                                                                                                                      PID:5156
                                                                                                                    • C:\Windows\Explorer.exe
                                                                                                                      "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                                                                      4⤵
                                                                                                                        PID:6532
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|4360|
                                                                                                                        4⤵
                                                                                                                          PID:204
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                                                                          4⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          PID:6288
                                                                                                                        • C:\Windows\Explorer.exe
                                                                                                                          "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                          4⤵
                                                                                                                            PID:5920
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                                                            4⤵
                                                                                                                              PID:7148
                                                                                                                            • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                                                              "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                              4⤵
                                                                                                                                PID:6668
                                                                                                                              • C:\Windows\Explorer.exe
                                                                                                                                "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                                                                                4⤵
                                                                                                                                  PID:6936
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|5920|
                                                                                                                                  4⤵
                                                                                                                                    PID:6392
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                                                                                    4⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    PID:7092
                                                                                                                                  • C:\Windows\Explorer.exe
                                                                                                                                    "C:\Windows\Explorer.exe" windowsdefender:
                                                                                                                                    4⤵
                                                                                                                                      PID:6660
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                                                                      4⤵
                                                                                                                                        PID:6892
                                                                                                                                      • C:\Windows\Explorer.exe
                                                                                                                                        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                        4⤵
                                                                                                                                          PID:5716
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|
                                                                                                                                          4⤵
                                                                                                                                            PID:5824
                                                                                                                                          • C:\Program Files\Windows Defender\mpcmdrun.exe
                                                                                                                                            "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                                                                                                                            4⤵
                                                                                                                                              PID:7024
                                                                                                                                            • C:\Windows\Explorer.exe
                                                                                                                                              "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
                                                                                                                                              4⤵
                                                                                                                                                PID:4372
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |4256|5716|
                                                                                                                                                4⤵
                                                                                                                                                  PID:4280
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
                                                                                                                                                  4⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:4328
                                                                                                                                          • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                            "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Windows Defender TamperProtection settings
                                                                                                                                            • Modifies firewall policy service
                                                                                                                                            • Windows security bypass
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious behavior: LoadsDriver
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:2568
                                                                                                                                            • C:\Windows\system32\wbem\mofcomp.exe
                                                                                                                                              C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
                                                                                                                                              2⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:464
                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                              C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
                                                                                                                                              2⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:2576
                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                              C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\416FA2E1-B68C-3B51-192C-5B37E51EDB12.man
                                                                                                                                              2⤵
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:108
                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                              C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\416FA2E1-B68C-3B51-192C-5B37E51EDB12.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
                                                                                                                                              2⤵
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:2604
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:3316
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                            1⤵
                                                                                                                                              PID:1684
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:1044
                                                                                                                                            • C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
                                                                                                                                              "C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
                                                                                                                                              1⤵
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:6056
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                              1⤵
                                                                                                                                                PID:4544
                                                                                                                                              • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                \\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:5992
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
                                                                                                                                                  1⤵
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:932
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4592
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1968
                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5888
                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3588
                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4984
                                                                                                                                                          • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                            "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies firewall policy service
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious behavior: LoadsDriver
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:6792
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:6984
                                                                                                                                                            • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                              "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                              PID:5548
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:1896
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:6456
                                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                            1⤵
                                                                                                                                                              PID:6572
                                                                                                                                                            • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                              "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                              1⤵
                                                                                                                                                              • Modifies firewall policy service
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              • Suspicious behavior: LoadsDriver
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:6704
                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:4104
                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
                                                                                                                                                                2⤵
                                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:5560
                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey B2D01FA6-8FF6-FB46-0B55-EBDD89201B85
                                                                                                                                                                2⤵
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                PID:5536
                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:200
                                                                                                                                                                • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3520
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:5112
                                                                                                                                                                  • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                    "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2800
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:5840
                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4084
                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4644
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6432
                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3888
                                                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:2480
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:6956
                                                                                                                                                                                • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                  "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:6656
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4552
                                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4284
                                                                                                                                                                                    • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                      "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:6612
                                                                                                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5596
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:7016
                                                                                                                                                                                            • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                              "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1624
                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:256
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2480
                                                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6616
                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5616
                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                        • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                          "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                            • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                              "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:4428
                                                                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2816
                                                                                                                                                                                                                • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4424
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:424
                                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                                      • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                        "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:2032
                                                                                                                                                                                                                          • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                            "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6576
                                                                                                                                                                                                                            • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                              "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:6540
                                                                                                                                                                                                                                • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1340
                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6908
                                                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:6652
                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5740
                                                                                                                                                                                                                                          • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                                            "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4772
                                                                                                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:6512
                                                                                                                                                                                                                                                • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6392
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:7052
                                                                                                                                                                                                                                                    • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                                                      • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                        gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                          • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                              • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1592
                                                                                                                                                                                                                                                                • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:3208
                                                                                                                                                                                                                                                                    • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:752
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:7104
                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                                                        • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                          gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:1568
                                                                                                                                                                                                                                                                          • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                            gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6456
                                                                                                                                                                                                                                                                            • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                              gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                              • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                                                                  • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5744
                                                                                                                                                                                                                                                                                    • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:6368
                                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:6580
                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3312
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:860
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:6864
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:2324
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:124
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:7096
                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:7072
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:6836
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:6720
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:6496
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:6868
                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:6384
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\gpscript.exe
                                                                                                                                                                                                                                                                                                                                      gpscript.exe /RefreshSystemParam
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:4720
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Defender\MsMpEng.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Defender\MsMpEng.exe"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:1348
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:2144
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\SecurityHealthSystray.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\SecurityHealthSystray.exe"
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6572
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6468

                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                                                        AppInit DLLs

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.010

                                                                                                                                                                                                                                                                                                                                                        Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.015

                                                                                                                                                                                                                                                                                                                                                        Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.012

                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                                                        AppInit DLLs

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.010

                                                                                                                                                                                                                                                                                                                                                        Component Object Model Hijacking

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.015

                                                                                                                                                                                                                                                                                                                                                        Image File Execution Options Injection

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.012

                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                                                        6
                                                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                                                        Indicator Removal

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1070

                                                                                                                                                                                                                                                                                                                                                        Clear Persistence

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1070.009

                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                        8
                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                        System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1016

                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                        symsrv.dll.000
                                                                                                                                                                                                                                                                                                                                                        • Path C:\PROGRA~1\COMMON~1\System\symsrv.dll.000
                                                                                                                                                                                                                                                                                                                                                        • Size 114B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        symsrv.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Common Files\System\symsrv.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpengine.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BC205E0E-D7C8-4859-86B1-16A8BB28A524}\mpengine.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 18.1MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 78f0315fa9ceff11787fb1b2eaa99150ed7024f8ac826f51ffa0fd7fba3fed86
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        E70967FA-0000-0000-0000-D08302000000-0.bin
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\E70967FA-0000-0000-0000-D08302000000-0.bin
                                                                                                                                                                                                                                                                                                                                                        • Size 312KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8b4dc368bb5a818a1765a9bd2f342318d6f09543ae34f2be2da9de2b6bdba0d0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin
                                                                                                                                                                                                                                                                                                                                                        • Size 28.3MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ed38854616c8ce2de194c637b28a5046c572011a75780db4f1fc37db1e3d755c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.01
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.01
                                                                                                                                                                                                                                                                                                                                                        • Size 1.0MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 19ec3509e9be9fa0621746aad4babcf6d98dc5c61df4ac4821e55063e5506191
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.67
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.67
                                                                                                                                                                                                                                                                                                                                                        • Size 29.4MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4ddc1dbc6e6009be73ed6377bfbe72a117e6040d6ba7a8f53b69769eae235622
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.6C
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.6C
                                                                                                                                                                                                                                                                                                                                                        • Size 3.6MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2ce9d6249a88e832c98c98862a79d2012ea828f2489384fbec533db1e7bba1c7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.7C
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.7C
                                                                                                                                                                                                                                                                                                                                                        • Size 8.1MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 270a823e5c747bac8b4d7de037b9a2d7f5ecc425785322736df4ab01fc3267ea
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.7E
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.7E
                                                                                                                                                                                                                                                                                                                                                        • Size 21.2MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f703ea07d7e38193bda53b205158f2aeaff6f08d1ed0b928fed4e9aa35f2ac60
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.80
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.80
                                                                                                                                                                                                                                                                                                                                                        • Size 12.1MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1fa59af8564f288cc62a4e6dd120624954e0efd2dc7e3e99018ab7d6d336f2e6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.83
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.83
                                                                                                                                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e7616d6de2933437ff7e1bf89d1a249cab4850239d94d942e0a64ab7284d6803
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.87
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.87
                                                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a167f77c7849bd06c8c3f66438dc3f9cfd7f434543dfe7b6401a0bd949e6a34a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.A0
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.A0
                                                                                                                                                                                                                                                                                                                                                        • Size 16.9MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e279dc6f8e7c205bd6f2e3cebbfec6fbd41fbc8e45cb79cefc8d035d65c0a9d0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.DB
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.DB
                                                                                                                                                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 46bf4dd7fba37c8ecf865f6a67bcc83f3cadf97649dafae119d2876e93db3f8f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.E6
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-5FD4EB80D6BB76F6D016134E84F300A0FE943B6C.bin.E6
                                                                                                                                                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fab51275ada343ad247c9ab1fd8a1b63f2b519bc04149a14436df7bbefc02db1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpcache-BF6C86ED14DBD8B8ACB5EC34FC802FF9DFD2EC42.bin.E6
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-BF6C86ED14DBD8B8ACB5EC34FC802FF9DFD2EC42.bin.E6
                                                                                                                                                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ef755292edf41d3e7250f6d85756486bad24ed0a09bacc9b698d10b24aca74c9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        mpenginedb.db
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 848a627dd40d200c8bdb76258dde0174598e6f59daf9cef084f29b5ab7521bb9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 686B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 09ce49a398a23fb2ba94f603f6f248141026d9ea1d75d8f8861da3804b6108ec
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b75ec5c96de47e1562815c20f245a75c048a3463bdf808ce040d1913e05d4802
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4c35bdc8ee020d07f6f497939233d20ed34404fd4b24cd70dd5df629c3fe4982
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2fef0dbb8613f824e9012446a0bf81460deb9a4719617e990ecdd59ba32cb237
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 04abf58f6d59910537d89afe009ef46007c50dd6cc892c9b2934c04b3683c3fd
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8fcd1b999c04247036b59ec04f76d4a739fb0a30a949310622bda9de678146d0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e45ef0ed25c855ab2f4547ee79e84983a7a5ad4d47d7052f43ba4f0dace110f9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f7551c2e7516d9cf449aac1ca21b2fd9803e251b117c7223265dbf4bd995ad6a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 01f77a655e1aee827aa62e8a2361b17252ad87486b2e502267e12b9b6c0e0ec2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 344B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 681a03cba476e1057c4d80983df273a91d0901a00da0ff3847c9eb9b912926d8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDeviceControl-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9af687196c03c93d420a60c35a91c920e12f61efb15a3fbdaa9a2665a370040c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDeviceControl-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f400366c2f81661227c2ad9b82657deb44751b68773ba58be23ce63f286e75b8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPDeviceControl-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 66989fea0d13af531d58ce7062e562a14bad1103da9e72e1104624da79b36e52
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPLog-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 70KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c3b6b588eed059e7cd48ba33eac2d43585c0040abf8618a14367c4a8bea8af84
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPLog-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 39KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e02c012914cc24f7d611794f0109582d5bd901fca53e263b00a2c70ebd762d98
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MPScanSkip-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows Defender\Support\MPScanSkip-20261011-234946.log
                                                                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.ini
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.ini
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2634ed9c9d3411b8650ee36fedc653d9eb738a03b06a2a89a571e5bd91be79b8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        3z2p4w4r.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\3z2p4w4r.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 37KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        2B2DAD4CAC.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\A1D26E2\2B2DAD4CAC.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 447KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Registry.pol
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                                                                                        • Size 160B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6509c7fc4fa70391399831bbc3d66206d3f6f8f2bb20ffcac4e04844861d733a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Registry.pol
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                                                                                                                                                                                                                        • Size 8B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5bb1f21f806938a043563024b13b33d74a2b95b767c5f81bde8456e9d0413a89
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gpt.ini
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                                                                                                                                                                                                                        • Size 233B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        416FA2E1-B68C-3B51-192C-5B37E51EDB12.man
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\416FA2E1-B68C-3B51-192C-5B37E51EDB12.man
                                                                                                                                                                                                                                                                                                                                                        • Size 74KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1114198d6d76348ef6a7b6ae528c77e06f51369802af24ba9ad5f56fc73cb63d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MpCmdRun.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\MpCmdRun.log
                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8fcce94ef8558e502b6ccf6620ebcc4c5b3224cceaf5b4f208c8118a29b2e298
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MpCmdRun.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\MpCmdRun.log
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d899c783b7fe50756c8a832e29e50da64cc9c8edd792d542f0a14873d2cd5696
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MpCmdRun.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\MpCmdRun.log
                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1ec337bb07e9224cb682a090f9aa85ba2f1744e8ebe792e4675d90e47fdc080f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        __PSScriptPolicyTest_masqy2ch.a3s.ps1
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_masqy2ch.a3s.ps1
                                                                                                                                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        1h6m7z6a.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Temp\1h6m7z6a.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 37KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7c3ca3161b9061c9b1ff70f401d9f02b2d01267bc76cbfcbc397a5aec60d4842
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        6k2z2m4l.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Temp\6k2z2m4l.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 37KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 557a903f0f2177e3e62b1a534dee554cf2eff3dd3991bc2310f064bf9c7d2152
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        aut2DCD.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Temp\aut2DCD.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        aut2DCE.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Temp\aut2DCE.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        aut2DDE.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Temp\aut2DDE.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e4049225f65908988c03a28dd4b1761fce7bfba08c57affcd25ce98203c19acd
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        memory/1672-196-0x000001DF701D0000-0x000001DF701EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1672-188-0x000001DF57BC0000-0x000001DF57BE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1672-198-0x000001DF701F0000-0x000001DF701FA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1672-197-0x000001DF70490000-0x000001DF70542000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-68-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-66-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-144-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-143-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-145-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-177-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-139-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1676-67-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1680-3805-0x0000014FFE7D0000-0x0000014FFE882000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1684-2818-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1684-2819-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1684-3254-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1684-2820-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1684-3255-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2376-176-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2376-148-0x0000000002BB0000-0x0000000002BE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2376-147-0x0000000002BB0000-0x0000000002BE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2376-146-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2376-175-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-243-0x000001A888F50000-0x000001A888F54000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-273-0x000001A89BAB0000-0x000001A89BAB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-250-0x000001A889020000-0x000001A889088000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-260-0x000001A875FF0000-0x000001A875FF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-249-0x000001A888FB0000-0x000001A889020000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-245-0x000001A888F70000-0x000001A888F74000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-244-0x000001A888F60000-0x000001A888F64000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-253-0x000001A875AC0000-0x000001A875AC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-242-0x000001A888F40000-0x000001A888F44000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-241-0x000001A888F30000-0x000001A888F34000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-240-0x000001A888F20000-0x000001A888F24000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-239-0x000001A888F10000-0x000001A888F14000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-238-0x000001A888F00000-0x000001A888F04000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-237-0x000001A888EF0000-0x000001A888EF4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-236-0x000001A888EE0000-0x000001A888EE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-235-0x000001A888ED0000-0x000001A888ED4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-234-0x000001A888EB0000-0x000001A888EB4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-233-0x000001A888EA0000-0x000001A888EA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-232-0x000001A888E90000-0x000001A888E94000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-231-0x000001A89B960000-0x000001A89B964000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-230-0x000001A895FF0000-0x000001A895FF4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-229-0x000001A895FE0000-0x000001A895FE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-228-0x000001A889FF0000-0x000001A889FF4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-227-0x000001A889FE0000-0x000001A889FE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-226-0x000001A889FD0000-0x000001A889FD4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-225-0x000001A875A70000-0x000001A875A74000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-254-0x000001A875BD0000-0x000001A875BD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-255-0x000001A875C20000-0x000001A875C21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-256-0x000001A875CB0000-0x000001A875CB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-257-0x000001A875DC0000-0x000001A875DC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-258-0x000001A875E50000-0x000001A875E51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-259-0x000001A875FA0000-0x000001A875FA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-282-0x000001A89BB40000-0x000001A89BB41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-261-0x000001A878900000-0x000001A878901000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-262-0x000001A878FD0000-0x000001A878FD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-263-0x000001A878FE0000-0x000001A878FE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-264-0x000001A878FF0000-0x000001A878FF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-265-0x000001A89BA30000-0x000001A89BA31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-266-0x000001A89BA40000-0x000001A89BA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-267-0x000001A89BA50000-0x000001A89BA51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-268-0x000001A89BA60000-0x000001A89BA61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-269-0x000001A89BA70000-0x000001A89BA71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-270-0x000001A89BA80000-0x000001A89BA81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-271-0x000001A89BA90000-0x000001A89BA91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-272-0x000001A89BAA0000-0x000001A89BAA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-251-0x000001A889090000-0x000001A889091000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-274-0x000001A89BAC0000-0x000001A89BAC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-275-0x000001A89BAD0000-0x000001A89BAD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-222-0x000001A888150000-0x000001A888697000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-223-0x000001A888780000-0x000001A888E50000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-224-0x000001A888EC0000-0x000001A888EC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-276-0x000001A89BAE0000-0x000001A89BAE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-277-0x000001A89BAF0000-0x000001A89BAF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-278-0x000001A89BB00000-0x000001A89BB01000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-279-0x000001A89BB10000-0x000001A89BB11000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-246-0x000001A888F80000-0x000001A888F84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-248-0x000001A888FA0000-0x000001A888FA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-280-0x000001A89BB20000-0x000001A89BB21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-247-0x000001A888F90000-0x000001A888F94000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-281-0x000001A89BB30000-0x000001A89BB31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-252-0x000001A89C5B0000-0x000001A89C676000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-283-0x000001A89BB50000-0x000001A89BB51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2568-284-0x000001A89BB60000-0x000001A89BB61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2688-36-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2688-63-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2688-61-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3244-2-0x00000000004CC000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3244-6-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3244-32-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3244-0-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3244-33-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4308-3288-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4308-2841-0x0000000000B40000-0x0000000000B70000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4308-2840-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4308-2842-0x0000000000B40000-0x0000000000B70000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4308-3287-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4776-3415-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4776-3265-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4776-3416-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4776-3264-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4856-3314-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4856-3315-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4856-3259-0x0000000002B00000-0x0000000002B30000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4856-3258-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5296-2506-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5296-2508-0x0000000001550000-0x0000000001580000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5296-2507-0x0000000001550000-0x0000000001580000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5296-2580-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5296-2579-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5468-2549-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5468-2585-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5468-2553-0x0000000002BD0000-0x0000000002C00000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5468-2552-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5468-2586-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5468-2554-0x0000000002BD0000-0x0000000002C00000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5596-3919-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5596-3921-0x0000000001320000-0x0000000001350000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5596-3920-0x0000000001320000-0x0000000001350000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6224-1308-0x0000000001350000-0x0000000001380000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6224-1307-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6224-1348-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6224-1349-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6224-1309-0x0000000001350000-0x0000000001380000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6488-2686-0x000001A1CC610000-0x000001A1CC6C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6500-1939-0x000002159A000000-0x000002159A0B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6512-2693-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6512-2631-0x0000000002AD0000-0x0000000002B00000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6512-2630-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6512-2694-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6576-3976-0x00000183E5450000-0x00000183E5502000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6776-742-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6776-743-0x0000000000B50000-0x0000000000B80000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6776-744-0x0000000000B50000-0x0000000000B80000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6776-822-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6776-821-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6896-1384-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6896-1386-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6896-1385-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6896-1442-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6896-1441-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6924-759-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6924-825-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6924-826-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6924-760-0x0000000001330000-0x0000000001360000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6936-833-0x0000012924EC0000-0x0000012924F72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6944-1391-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6944-1393-0x00000000033A0000-0x00000000033D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6944-1392-0x00000000033A0000-0x00000000033D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6944-1446-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6944-1445-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6964-2689-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6964-2690-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6964-2624-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6988-3911-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6988-3913-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6988-3912-0x0000000002B70000-0x0000000002BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6988-3979-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download