98aa14a1acdb9aafb212c27f7dbfca84f2d8c65961fd6b3dbe387347cdc9a7ae

Analysis

max time kernel
4s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
Size 24KB
Sample261014-mdrd7as1es
SHA256 98aa14a1acdb9aafb212c27f7dbfca84f2d8c65961fd6b3dbe387347cdc9a7ae
MD5 0fd31b9b7c1e55daa5fdfe67196fc3ea
SHA1 445de71ea43e94b416b7732b91fce7dd5590f3c2
SHA512 383e3e2ec04244b7b87cb0bc39138a5b70bb6453abd5a1bc7d683ce1a56e79620a610fd565d292ba27ed61e4f319270843b463f49cb98468f7a1e7b279c7448b
SSDEEP 384:HD+qvPXAq7l8jQCy81MfIrr4AX9HzTXCu4R+N:CqvcsUHzTXCDE
TLSH
T167B265A3B79CD8A7D7D285B20876C9E45129FD244681CF5F8199392CEC352A3BCF071A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1892	mspaint.exe
1892	mspaint.exe
3328	mspaint.exe
3328	mspaint.exe
3360	mspaint.exe
3360	mspaint.exe
4276	mspaint.exe
4276	mspaint.exe
2000	mspaint.exe
2000	mspaint.exe
1580	mspaint.exe
1580	mspaint.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
1892	mspaint.exe
3328	mspaint.exe
1892	mspaint.exe
1892	mspaint.exe
1892	mspaint.exe
3360	mspaint.exe
3328	mspaint.exe
3328	mspaint.exe
3328	mspaint.exe
3360	mspaint.exe
3360	mspaint.exe
3360	mspaint.exe
4276	mspaint.exe
4276	mspaint.exe
4276	mspaint.exe
4276	mspaint.exe
2000	mspaint.exe
2000	mspaint.exe
2000	mspaint.exe
2000	mspaint.exe
1580	mspaint.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 4876	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	90
PID 440 wrote to memory of 1892	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	91
PID 440 wrote to memory of 4620	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	92
PID 4876 wrote to memory of 368	4876	calc.exe	94
PID 440 wrote to memory of 8	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	95
PID 440 wrote to memory of 3328	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	96
PID 440 wrote to memory of 4596	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	97
PID 8 wrote to memory of 5656	8	calc.exe	98
PID 440 wrote to memory of 4540	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	100
PID 440 wrote to memory of 3360	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	101
PID 440 wrote to memory of 2300	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	102
PID 4540 wrote to memory of 2796	4540	calc.exe	103
PID 440 wrote to memory of 1772	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	104
PID 440 wrote to memory of 4276	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	105
PID 440 wrote to memory of 3376	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	106
PID 1772 wrote to memory of 2800	1772	calc.exe	107
PID 440 wrote to memory of 3588	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	108
PID 440 wrote to memory of 2000	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	109
PID 440 wrote to memory of 1788	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	110
PID 3588 wrote to memory of 3040	3588	calc.exe	111
PID 440 wrote to memory of 3472	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	112
PID 440 wrote to memory of 1580	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	113
PID 440 wrote to memory of 1756	440	jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe	114

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.KillFiles.dhbg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:368
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1892
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4620
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3328
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2796
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3360
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2300
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4276
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3040
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2000
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1788
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3472
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4724
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1580
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1756
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3992
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4900
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3556
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4372
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3960
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3352
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5612
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1268
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4548
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3372
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1928
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:948
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4640
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:908
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1000
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3908
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2232
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4792
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:2304
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1980
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2612
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2120
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5192
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5532
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4076
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3316
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3668
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4332
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:236
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5600
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5580
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3576
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4508
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:2492
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2872
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5572
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5956
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5652
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5796
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1320
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5820
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3032
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3504
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6032
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1264
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6100
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4500
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5692
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6156
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3164
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3984
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6284
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6212
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6232
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6328
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6404
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6352
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6380
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6464
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6564
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6484
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6516
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6604
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6708
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6624
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6648
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6728
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6812
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6756
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6796
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6880
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7008
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6900
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6924
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6988
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7120
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7024
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7084
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7164
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6200
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5972
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6244
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6556
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6752
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6560
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6612
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6892
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1272
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6984
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7072
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7208
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2500
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7176
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7252
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7384
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7272
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7292
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7492
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7392
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7432
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7516
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7600
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7544
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7580
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7656
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7792
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7680
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7700
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7768
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7852
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7804
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7860
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7928
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8044
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7952
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7996
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8064
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8164
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8092
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8120
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6884
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7428
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7240
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7316
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7592
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7932
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7660
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7772
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7940
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1564
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8132
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6896
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8268
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8200
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8244
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8340
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8428
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8368
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8400
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8492
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8612
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8524
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8572
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8648
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8784
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8692
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8732
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8832
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8904
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8856
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8884
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8980
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9072
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9000
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9024
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9132
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7756
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9156
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9204
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1324
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4908
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8388
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8660
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6116
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8836
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3420
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9148
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9112
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9180
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5980
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8988
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9272
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8640
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9224
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9304
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9412
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9332
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9384
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9460
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9580
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9492
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9532
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9608
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9728
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9640
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9684
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9744
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9860
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9780
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9820
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9908
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10004
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9928
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9968
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10060
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10184
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10080
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10108
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10196
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4048
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10228
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9260
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9424
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9636
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1352
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9520
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:9632
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4912
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1816
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5688
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9152
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3384
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10160
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10204
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9664
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9328
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6112
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:2528
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3476
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10132
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:2776
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10348
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10280
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10316
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10396
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10492
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10420
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10456
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10552
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10624
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10572
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10612
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10684
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10784
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10712
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10744
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10808
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10900
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10840
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10892
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10976
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11100
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10996
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11040
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11108
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11212
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11144
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11176
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8720
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10480
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2584
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10276
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6548
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7344
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6000
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10756
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10832
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10388
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11084
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11256
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6968
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11300
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10980
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8056
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11348
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11452
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11380
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11420
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11496
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11588
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11524
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11560
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11640
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11784
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11672
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11732
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11808
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11908
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11836
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11868
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11960
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12056
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11980
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12016
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12104
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12176
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12128
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12164
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12244
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:3516
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12268
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7184
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11444
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1392
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11516
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3216
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4120
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11896
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3428
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:244
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5392
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12152
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:11976
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:3500
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1668
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8320
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4488
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12256
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1520
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1232
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4804
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5844
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1304
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:944
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4924
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1764
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9456
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4324
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12332
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5684
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12300
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12380
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12468
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12404
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12448
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12528
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12668
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12552
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12580
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12660
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12776
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12700
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12748
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12824
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12948
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12860
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12920
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12992
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13140
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13016
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:13040
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13104
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5500
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13216
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12400
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12624
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12944
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6296
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6504
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6820
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13108
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6908
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6944
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7140
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6828
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:6252
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6772
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7136
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13332
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12828
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10972
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13380
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13476
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13400
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:13436
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13520
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13612
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13544
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:13572
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13652
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13784
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13680
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:13716
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13792
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13860
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13820
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:13868
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13948
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14040
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13972
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14008
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14092
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14216
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14116
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14144
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14200
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14332
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14240
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14288
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13328
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:7824
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7508
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:7728
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7876
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13852
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:13760
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8012
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11332
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:6996
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7972
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11492
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8288
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4364
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14132
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14328
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7620
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8760
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8588
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8620
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:13816
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8292
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14028
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9020
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8232
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:13644
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:8424
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1300
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:8948
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9244
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3536
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14280
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:7920
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14404
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1380
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9616
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14396
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14484
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14432
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14496
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14556
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14680
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14576
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14632
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14716
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14840
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14740
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14776
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14828
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14952
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:14860
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14924
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14996
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15104
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15020
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15040
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15136
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15252
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15164
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15196
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15288
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9696
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15312
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15356
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14412
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14560
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10048
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9884
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14676
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14836
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3808
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9324
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:14912
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:8472
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2348
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15000
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10200
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2228
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:924
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15192
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10288
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:9800
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10432
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5608
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:14940
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9788
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10236
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4384
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:4628
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15276
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:10512
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12816
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:9980
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10452
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:6544
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11272
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:7504
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:10556
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15412
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15528
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15444
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15476
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15572
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15708
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15592
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15640
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15700
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15816
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15736
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15796
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15924
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16064
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15956
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16000
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16052
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16188
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16084
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16160
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16236
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16352
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16260
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16300
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16380
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:15440
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:10700
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15428
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11816
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:11924
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:15584
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:11688
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:11888
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12076
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:5576
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16144
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:12276
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:10644
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16256
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:5316
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12248
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2060
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:15788
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16076
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4168
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:1612
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:9420
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1500
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4020
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12040
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:6292
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5160
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16416
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3784
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:14708
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16456
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16548
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16480
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16520
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16592
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16696
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16620
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16676
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16744
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16844
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16768
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16820
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16888
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16988
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16908
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:16940
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:17024
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:17124
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:17048
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:17092
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:17180
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:17288
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:17208
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:17240
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:17348
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12432
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:17372
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12416
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:16516
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:12880
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:12716
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:8548
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:15128
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:2704
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16648
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12956
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:16936
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:16832
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:1596
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:4788
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:3692
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:12756
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5872
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2508
- C:\WINDOWS\SysWOW64\notepad.exe
  C:\WINDOWS\SYSTEM32\notepad.exe
  2⤵
  PID:4352
- C:\WINDOWS\SysWOW64\calc.exe
  C:\WINDOWS\SYSTEM32\calc.exe
  2⤵
  PID:1344
- C:\WINDOWS\SysWOW64\mspaint.exe
  C:\WINDOWS\SYSTEM32\mspaint.exe
  2⤵
  PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 14KB
SHA256 c8ce217f126a58e4964adbfd15f8168432e8a612f094e52240159857ee8654b7
MD5 87a34af59fb71e1c4092a3b55e739c23
SHA1 9659fd359427072241a0fd9f01332a36f88c9276
SHA512 d3177a51d9447a4653e09873e7fbbb6d924211e699cb48bb46a649b7e78892de98800d4aad071f9e84c4779c5ba0d8e26545157492aa350658793c8e1bff51ec
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2SR:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnE
TLSH
T12562DFD8C4816C9BEB8F300ECB9511D41F5F9DCA59F210660A3FBE9690AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 16KB
SHA256 bb4a598bfe9107ddf2a38f2ab381f035508aa2448cc79cd1f402ec2884662355
MD5 76b42ceea29f4783733d416f9f5e03d8
SHA1 ad58910286015f20010664aa81242f3702e22632
SHA512 205f297b2303fecd27b7e3e2aa2b18157c5b48360fa205b259fdd50c351b6974c4fd55ec97e82bccab4ebbe9e26d3c1e304d5552830d21f401926065cc9579cb
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2SU:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnN
TLSH
T1D972F1D4C4816C9BEB8F300ECB9511D41F9FADCA55F210660A3FBE9690AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 17KB
SHA256 870b8a14a8e10034a3ebd0274b42fdb2f60a9d3c31c6825668c3eb37a0a83b12
MD5 57ad47a6c227b13b800dfddf6e9ea1a4
SHA1 3d0ec2eebb95b2b0c0d1757c36da2d4f6b17e831
SHA512 d479d9d098ea84a20c24554b39c9e6aa199b0e4abbb96359227d4b18cb9e28a8955e942cab6a8ee00870ce04436f48b02540311cf32d7579a09cf23a3f94cd6c
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2Su:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnx
TLSH
T11E8202D4C4816C9BEB8F300ECB9511D41F9F9DCA59F210660A3FBE9690AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 19KB
SHA256 905225f0fd6fe9186021886de1ca053071d634abaee75197a5ecf2f5fbf5b8cd
MD5 914f2a303774e211c140a6a6222def4f
SHA1 0273d844cfc85afe9988e672d555e9a46f5fd941
SHA512 3294ad7778ebc5e58f770096882af155fdc8c14d7e4bbcb32be5fec30fada7f2ac084e8eefd73918923100e84cda6a0542895df1469ef21a3e9a88ad33570ee4
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2Sk:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnD
TLSH
T1FB92F1D4C4816C9BE78F300ECBA511D41F5FADCA59F210660A3FBE9690AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 22KB
SHA256 7d027f3de4bf8d2aefaa9f6a7c4a6a9742e0018629f715384552c536efe8ac0e
MD5 08bd1a8ad730859837c64c267b588996
SHA1 458a3cfee6a8053eac863544aa09a8580f00f1b4
SHA512 12037d4ca1facf5f70129ace84064447a0cf92958fb602870fddc65ef6ae3efae76c828a7d0e7401a1d9bedf07557a31005320c8f74a2e87980b93790ddeb8b9
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2Sx:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnS
TLSH
T1BDA2E1D4C4816C5BE78B300ECBA511D41F9F9DCA59F210650A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 22KB
SHA256 d9cc7b08eb8a803bf48a2a56131ba2d6c351417a36029eff4bee303bf4b4e3d8
MD5 995b6a0577ce5bbf2a8f1c96473a0be8
SHA1 9323bfbba93ae25a092f43445ab28e56fc86c7c6
SHA512 f7aeac11ccc61ae452c5701e8ffd8b685f55a7b2d8588df5fd002378616f230e8dcdd7767ab7defb8ed5ce07a48d1c619b0e9560351144a841b3efd1eb84fe57
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2Ss:899Jym9DwnIudbbnw9DR9dwnd9qQ3tn5
TLSH
T170A2E0D4C4816C5BE78B300ECBA511D41F9F9DCA59F210660A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 23KB
SHA256 a06ccb5ca6817b544137d033a898c654b3b8a35ad4be71597b55e4bae3e992b4
MD5 4b02c06404eea4e05d887f36e47de865
SHA1 399f5a636fbcd8d78661e3c2d07ec2219c34fe13
SHA512 cc0e3b250a09707eec0a6d083bf7947d1b42f892ec34ad3d0880659205c1da18e15f4028b5b444967d930c67648405e35b0ef7db4f9a974dfdeb9cbc88e2e29b
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2Sk:899Jym9DwnIudbbnw9DR9dwnd9qQ3tn5
TLSH
T1C6B2F0D8C4816C5BE78B300ECBA511D41F9F9DCA59F210650A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 25KB
SHA256 b1df523bc83916b748e983945a3875172c1a2fb98ba781e88e3b9a7e5ad4f17b
MD5 4b1da0fdad9bfecd147f093b74b06747
SHA1 18d753af891cacad7d7cf8799b74f7ca35d57977
SHA512 3c24fb0ccdb950e784e58d528b1b1efb9c8c37f58a6d9116ff586361199f760163a3d7e4432991c2473800acd9b276e5222e4b5d889c0712d0356c9da08ef19b
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eb:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnF
TLSH
T1D1C2FFD5C4816D4BE78B300ACB9501D41F9F9DCA59F210660E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 26KB
SHA256 8e6ce36e87d9caf51ce5e49fa71c3648a9fd19a9bc77d0c4ec11fa49c25d81e9
MD5 bbbaff46ad3c58c9380d5fa79b48720a
SHA1 4a6c77270a5e33e13ac9ef37778df6d377cb2162
SHA512 3ee70286cf79477c79c97549b33b8ec3d5cf27f764b93b55e80b392f5270d2dc199185b12318b67a95ba9e144e987e611de89f568d04387d37a596c29b684da3
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e9:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnf
TLSH
T17FC2EFD4C4816D4BEB8B300ACB9511D41F9F9DCA59F210660E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 28KB
SHA256 6c2e1b017f20561993c6690c4e18a59c80e42e0aac2d28934c9f6c253d383ba0
MD5 cb9d19f706c59edcb0cf8e0d2ac347e7
SHA1 5b9a1399db6a85158e4d1a95b08339497bea2ff3
SHA512 c76df7ceb2d8def79c43a571790e0ea08526fd9327d3a8d32d03e841eda774629517e9c7830e57ee8bc26627c144f36b14042053b3ecc4cb54ebffba442eb1c5
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e3:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnp
TLSH
T175D2FFD4C4816D4BEB8B300ACB9511D41F9F9DCA59F210660E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 7342ba6f4e8c535437daa72713bc5bd898a29ac297efbe514449f00617bc3ce3
MD5 39d0283b78ea5f5f1e435a205fcb4b05
SHA1 30804674c6f0a471636b0bec1de228defa6ca4fd
SHA512 a4fd06e2974be06bed1217ca0bb592ca9c63c2a7f6a223af8f23b81ca1c89e7dd6d65e95eb60c20f93a160422998c79afc985bec41d645a78eda4194d21be125
TLSH
T124519CC8D0916C9BD78F304EC69400E92B6FD8CA55F110654E2FBA9A90EE19C87D7417
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 29KB
SHA256 12b3f03330ad5c2998f063640b0bb37d9532ce2fdb7f383ca0a27dde6d9ba80a
MD5 8387b4ad83d019af5a9f1f10d79fc0a5
SHA1 ca0f8bb93afe1662056f96cbc99179b8fa44f585
SHA512 47ba0fbc6d4070d32c56f6479c77e5212c95049739ac2b4756c5c58ba3d877ff79e201b7faa8e9a36dc07d2b63f2161f4a3493cfa00a4a55c2627a1533642ff4
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eQ:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnm
TLSH
T1FED20FD4C4816D5BEB8B300ACB9501D41F9F9DCA59F210260E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 31KB
SHA256 c1d463506c44363984bb1efb37274d2546802700353c89d024eff49795b6ecb3
MD5 8ca566c3c3c7faecc5ba8c004e34550f
SHA1 23028aff6a2dce7cea590ac21b1589c1b2b307e1
SHA512 015700d3c082c8986e9a8b973f236b192207e5e780c6cb9f49c5ce445fc91c4c6f6ff3f32348fc0f7cf361768c29b8684be0f3db2dda57f9610c6277cec5f772
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9ej:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnR
TLSH
T1C5E200D4C4816D5BEB8B300ACB9511D41F9F9DCA59F210260E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 32KB
SHA256 7ab43a677da6be856164e75e28d4ea919241bb8a1d30e564113fc92a43f91675
MD5 80314b39de3d44ab814af90a6e39c281
SHA1 5824fd687b512374d997c8b76da7c0b00a2fe072
SHA512 a262cd680adef2d43e502e5789954f33f4371d65b707aa73e64e442a721e70a91adeed281875d4a7a42422ffa0ee70be53237283cbd61d701fb0ae221cabef2b
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9ex:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnH
TLSH
T134E210D4C4816C5BEB8B300ACB9511D41F9F9DCA59F210260E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 35KB
SHA256 e42aca25b9377a10e66d19c2c27794cbac10c333305b2727fc8cccae831cab7d
MD5 059c814c80669260c700f4d1ac219405
SHA1 6808ca1441104795c2adbabbb2ee6614ed2de729
SHA512 79223227d70f76a33cfa98d60d8cf5f5b3d62dcd024b69614e8a3b5104b03493284cbde177f60291108615237739e76f68ab199500316911ab9eb2e764f74066
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eK:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnM
TLSH
T1A7F2FED8C4816C5BDB8F300ACB9511D41F9F9DCA59F210660A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 35KB
SHA256 430550b174423d2fef1bd661ae3aa35db42b9dcdac586864ade0717dc414daaf
MD5 e1908fca4a412668fff91907c24442e0
SHA1 b26d29c8ad06417f21474fb315f31b84f010d1df
SHA512 1d9210c0cd793ae7b56eb70644e4b8f244417fc33078e4781c3d6601a336c7d35d5094e45b3a4cb95a2b0538d93a234356554806e3cdb39e4b580c05ec7c03e9
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eL:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnp
TLSH
T18DF2FED8C4816C5BDB8B300ACB9511D41F9F9DCA59F210760A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 37KB
SHA256 3dd6615cb80f38e1b0f13838731f863b5a9ac8bc168edb9f8d060505c60ae4fb
MD5 d8a4aec56564d02af795a07c76946cf0
SHA1 85ccebb4205d40bee665ea16c28322d075af5ff2
SHA512 50d1fc0d2a69eb335e1d6c3457886d5736599b1117b1bb50ea4064e6b875eeec813fd014fce0752a742d5b2819d64ab7332100e35a807059931d000d07194714
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e4:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnC
TLSH
T1BF03EDD8C4816C5BDB8F300ACB9501D41B9F99CA59F210760E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 39KB
SHA256 866c4c25b307b80c896328c111e669e85034633a871a132073e810e3a5c56059
MD5 995c454570af91c1ec95420352b780ef
SHA1 9b95dfdbd191d48566b62f746592f2dfa0292352
SHA512 9aa8147480944449f6612b37f0767cea3267f56520a361f1dfbf3d87379096591ab419b3bd95c84c6ac4bea79031bc8dda688ed426a9c6c0b2bdef4011995817
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eI:899Jym9DwnIudbbnw9DR9dwnd9qQ3tny
TLSH
T1FC03EDD4C4816C5BDB8F700ACB9901D41F9F99CA59F210760A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 40KB
SHA256 19f0cc6c95fc04d571024bd2b5c32fd96905997cdc49c004cefd1b29413dbfb5
MD5 609f19a3b31ae5c35aff78d879f4f440
SHA1 1fce1d6a45023132dd790723d42ebfef97fcb141
SHA512 9c265c0fbab8ec4f8176d74062cfdb92e8a4883d72a0cd152a920a0559ebd1204724e6c6b8216f2651fb603482bf3aea67e240c2ce534f2190fa862810aed0a0
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9es:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnW
TLSH
T1FB03FDD4C4816C5BDB8F300ACB9911D41B9F99CA59F210760E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 41KB
SHA256 868ca0e552c92a0b9a23e4be745e92af6b7e47b0a8f339a30c30538c829f0dc9
MD5 d1684f6746362ec8f0cc525f175d4032
SHA1 8f322e5ea9135856f5cf920923818a89f4daabc8
SHA512 cd40c14c424b285ab2057a3cfa1ca786b876484a4770539f17ddc62e5cef94848e93af6c8c961707f8ad4df1671710473bf110f28380875a8fc7a292dbf852c6
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eE:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnO
TLSH
T1A413FDD4C4816C5BDB8F300ACB9911D41B9F99CA59F210760E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 43KB
SHA256 005937928774f59e29981da09bd1075aea3e66fd8a377540fb662971030b0a96
MD5 f579cbd08bde584086a577960c725ec3
SHA1 824cfe133c591a57b9f0853a8ea65c0ca7e6d50c
SHA512 490fcf00fed8e2966798cb86ae908ddad850e6309cb0dd523cd9d6b7226a1dd673b845ceed3a2a70049b3e6828c813b0096cb2fa08624bb2904900760e513874
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eF:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnH
TLSH
T1CE13EDD4C4816D5BDB8F300ACB9911D41B9F99CA59F210720E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 a094085a5e9e1af02b8f0a80a75bde9db624f260107bbeeb0fbe68d2913ebf7d
MD5 32f855c2142e859d3915f4d237f1e3bd
SHA1 2e34970ea608ab6358681b64df0e1f7fcbcfebf2
SHA512 54f60dc27b0d1655a3b6c664cdbf7ee0430d04184268ed8f68e8e32b1e9547f955bf15987b5bc85d5f2a8276eb5192066971f5b8845a93d9c1f2c4a56a0c57c9
SSDEEP 96:0TSm9S2S3RzoFRHqXS3RzoFRHVMqYpLSmDSdFSwKlSa4lS3RzoNgRH8llS3RzoN5:0TSm9S2S3RzoFRcS3RzoFR5YZSmDSPSa
TLSH
T16A91D0C8C4816C5FEB8F704EC79500E41B6FA8CA55F211664A3FBE9690EE19C87D781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 44KB
SHA256 563f34da1223777c13e0a81d5ded84b28dee1be79018ac967f9bba79eabead67
MD5 ea660dfd293e45ded177ffdcb4c624ee
SHA1 278dd6d3d884497c2322fd4b078fe0ddfacb9592
SHA512 bd3b8accd89de557585e7d9abb0f7472ae4e95619a8f8263a85272190d18f1c59991e1e7c508b53fe53749f8a781e138bcde4b2081fa8d953d09eedce1c1c348
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9er:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnh
TLSH
T1D323FCD4C4816D5BDB8F300ACB9911D41B9F99CA59F210720E3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 46KB
SHA256 d8136339f919757c1a616f40c1ebc1bb7acd8f68bbe6d39b125f926ef2e442eb
MD5 7eef6452ca35b846bf84c693a5e2ebba
SHA1 364149ef7768435e00c8ec61923ad2542209b9ca
SHA512 87fd8d7db96248ec5f7b9cc6af645422dc8902f510632c96a89b481d5238d9ac9ed1f8fbe53ba4e201e33527e6b5d020846766615ce2f1ebb4dc22dca1fc98a5
SSDEEP 768:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eV:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnL
TLSH
T19023EDD4C4816D5BDB8F300ACB9511D41B9F9DCA59F210720A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 49KB
SHA256 2d493e6b6b65e64f9ffa3a028c5d1cbbc430ff47d35375e249452ed5c73c687f
MD5 39fbab880799e31a7b76b5356d0f6fb6
SHA1 3e59d879267bb05e3598f2b63c9f1aa9f8cfd388
SHA512 997ccca5ada1798acd722d31bc436f4b4ec7b3508a98ab1e2dbc8dd7dd1518864402200cfc950ec9dea81d60f1d1a1dadd51e4762496395e3a7bad9073d99f79
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9ed:87JymFwnIudbbnw1R9dwndwQ3tnnZv3F
TLSH
T1DA33FCD4C4816D5BEB8F700ACB9501D41B9F9DCA59F210320A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 50KB
SHA256 15b233f41e4a333ac5112f240598e5580622d8d0fa04415748879506d6ac1b80
MD5 177ee010acec61281c6d5217ca6cd646
SHA1 a6d0d5a7ab78a2b114f9949a4f10335a64b78493
SHA512 d618f9e9505cea532aa8ab20f8fc02eb02fbe45d2a732b161cbe7af8ff4e62c216cbd3ea7c5db743c18ace512f1c749633f43c205999897c2c0bced31377995b
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eL:87JymFwnIudbbnw1R9dwndwQ3tnnZv3T
TLSH
T1DE33ECD4C4816D5BDB8F700ECB9511D41B9F9DCA59F210220A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 52KB
SHA256 ef652ca1049d1662b4e6689b7b1ca3f92e1f16802a8c672d3f945895e497b251
MD5 b513343f3574c53bd339624b028d6801
SHA1 0548b07e4b4e84aef3755d7cf6b465c7288c93e7
SHA512 6c867f00518566dac85fcb289e130022d12dc8b6ad978fdf9138c1778d70361dff24b69fedfbf7e8beb3cc591b920aa1977a14b30ec7a5f7a5cda07c7a4fca1f
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9ez:87JymFwnIudbbnw1R9dwndwQ3tnnZv3b
TLSH
T11A33EDD4C4816D5BDB8F300ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 53KB
SHA256 3a5f030898ef260ffdc332dd2094db985bf0be4124176b64355c84728374e9df
MD5 0dc91483cb261db276c57e9191f12756
SHA1 52d796ce4121eae58bc2fa2fd9d555321938d332
SHA512 d3437cc8ff59bbb196a14defc41a90ccdd9cb4eaf079f2d73dd206c0b5241ac80601195be5035db7ec16011918a943284008bc790ef66ab0e0f154db4d5a099f
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eW:87JymFwnIudbbnw1R9dwndwQ3tnnZv3+
TLSH
T17743EDD4C4816D5BEB8F300ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 55KB
SHA256 eb72c50a51b0e260aa3d46b669569385217f797019bef02ac2f5d5ebdada7750
MD5 a02c8b94cf64be6ccbd39ff8467abf05
SHA1 cb229ee0fb278f852e7be8696260f774848483bf
SHA512 4d55f75f0201135083f460ecb8ad167595e0f13f7178901dadabc74fbf47b3e63b6c9068d185a88c9eecc585ee0bb3176d51a1b6e569c824c334be37b04463f2
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eG:87JymFwnIudbbnw1R9dwndwQ3tnnZv3u
TLSH
T11243FCD4C4826D5BDB8F300ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 56KB
SHA256 432ad5e5f2bba97e93e75864ae1d91ee930d9ed0eb256cb24e479a80e93e1ad1
MD5 555fb7bd3f9dd1a232913c957659121b
SHA1 24019d35c1937f7fe330545a8b196d5c75b35ea7
SHA512 d452efbe34612e3d599c044f9bc76069f2d561c6ec541e1f809155183ab7a3373b32621b3a88907c83da1c62585c46bf3f3bf8c4dc5aec72e10fd7a5cd30f18c
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eh:87JymFwnIudbbnw1R9dwndwQ3tnnZv3J
TLSH
T1BE43FDD4C4816D5BDB8F300ECB9511D81B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 58KB
SHA256 2951f94e1396bec98509b04329ab180fe99adf45a76049a1bceda65250ae6614
MD5 cf08caae18907bc2b35c9155c82792ed
SHA1 ed218f12b7690deba96b4328688fa03d0470326f
SHA512 939517fa8dd3e66055953e0c9c5a5aa277ecc3912c06ddf736dc6471f1de654fc9b4ded89ec41c7bb60b8040233229741e2b4e9d9dd5bc197da895fda21c9550
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e5:87JymFwnIudbbnw1R9dwndwQ3tnnZv3x
TLSH
T1DD430DD8C4816D5BDB8F300ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 7597a39d376bd148ae44ee362cb0f9219ff035a04464cc0a7f1d48c2fdf3bd0e
MD5 974a76a5028decbfb01defca2fd9828c
SHA1 5f2ef48514ecf90c3a2c616edf14670bc032bc88
SHA512 2a33016eb874544b67cca6b5c5c8ca2258aef4f81ec21cebcb6af71389bdf7aa46855dbb86871e5f27702435302830905c62fa1470f4b8352414fe08948094b5
SSDEEP 192:0TSm9S2S3RzoFRcS3RzoFR5YZSmDSPSwKlSa4lS3RzoNgRcllS3RzoNgRc9bSgb9:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwi+
TLSH
T11DC1EFD8C4816C9BEB9F304EC79501E51B5FE8CA55F210264A3F7E9690EE18D83E7827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 61KB
SHA256 eb5a4dbdca719f42f6a87bd8375c9870eab05d7271f9822f07fe04fa65f94a24
MD5 c0e8da54ac03428a6a0208c277411b83
SHA1 bb3f53a0bc12d3c348700426614939e441020219
SHA512 90c6c3cad798b6ac1ff4880c333b270c576ed6453cbe84f4544873ece52cadc95b86f1c2b43f53205ddb709db2fea52b7fa6afa3e6bb248deabf5c41a41d3abf
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e2:87JymFwnIudbbnw1R9dwndwQ3tnnZv3O
TLSH
T1A8530DD4C4816C5BDB8F700ECB9511D81B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 62KB
SHA256 f2251f7e35c033885c30b9b42643afa4d5ac4be3d8a6202efb6df27acfa809f9
MD5 2f1d7e4781f71fa071a4a4cfcd224fd8
SHA1 fdb380b08e3d8d910901ce76795e1940659c934f
SHA512 431c17a2b453ba7ada56ebb6ecc7e547b93ebf8c925fa15959e4d43c2a2bd5470d84b4fc7512914492ed2cfd00d7d622fc80a071305f84eeebd4e722852712d9
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e1:87JymFwnIudbbnw1R9dwndwQ3tnnZv3N
TLSH
T16153FDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 64KB
SHA256 dac0606abf85428d834215ae5fdb9d2b31ccf6f591fda7d54399d0aff56f5f52
MD5 2f8ba3b9507b8f53d4a4f0859f1e2cfc
SHA1 56548753f140a95267fc05b5985574aeb4c134e5
SHA512 629c0d55c9e6ff11d84ecfa4890a3cba693476d9d9d6a2431a6a2d40915356e897c4aa881ce6575d228ab82203abfbc43645fb9529b58aff0cdd82df4a9ec0ff
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eX:87JymFwnIudbbnw1R9dwndwQ3tnnZv3P
TLSH
T12B53FDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 65KB
SHA256 1b97fb25d64d7ace24a010de8488552b6a472e90d4d4ac636beda45610c91eae
MD5 451433aff2b1e2b7e810152421d3941b
SHA1 3b349c9c720e5662d12a8ad72af530f1c38be12a
SHA512 82f1d2dc36944f9dae86725e4a1b6774033e301ef226dea66b3e11f2c4ca6da56c4d91e4391f25adcb74ec6b3dc4bd2168beb205d01c77d35e752cfe588e46a2
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9ek:87JymFwnIudbbnw1R9dwndwQ3tnnZv38
TLSH
T1D663FDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 67KB
SHA256 1d94d62d7dc772eb457493176d0b147d6c2dae89674b30415127e550ddc842e9
MD5 bac0508358a9b489812e6de74fe1c6ab
SHA1 f65049897043773524429b0294d1f5c2c82cdefc
SHA512 97263c012a706fe6d9a1e53736d4ccd15103b43f08dcd0c9203bd73f8a90f4fdb8d09bef4ab58aff67f88fa9257b0defc37e9c01b58ee26c0d1a0e8ba3dce122
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eZ:87JymFwnIudbbnw1R9dwndwQ3tnnZv3x
TLSH
T13363FDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 68KB
SHA256 cc42397be26683af72d4e7d91a29e205fe2f94b0b76ce6bd1702f3e4995fe8d8
MD5 e1ffbf5a8f244bd0991478968f7de326
SHA1 3af6f22143a0141145526e169eea500c0f6ac48c
SHA512 f6ba199c331edf927fae3017634ad22ea617bad5f54fa990e1acf4d1147ee832904811d5893ea80d2bb95205409cf10a5a0f72389de9b1fb39c98640ffc264fb
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eB:87JymFwnIudbbnw1R9dwndwQ3tnnZv3Z
TLSH
T10A63EDD4C4826C5BDB8F300ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 70KB
SHA256 1b3a423bffaff51dfc5ced23861b24cd0d0b92bec8887931fc5a74801c39b2fc
MD5 431a03a90c3e4beedd11a07848a1427f
SHA1 beddeb74ecedb19a6d461e59dc3a82922027b10c
SHA512 e788da6a4993d5f39f3cd9a43d8af22de9167c9941b0565c1360876fa00b6e112ee59cd9717520acfd9dcd347192240574976f36bb088dc041e5f9320d436759
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eu:87JymFwnIudbbnw1R9dwndwQ3tnnZv32
TLSH
T18963EDD4C4826C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 71KB
SHA256 00eccccbe224884fb96303644f0ecee409752f8b879c75a4dd6e6a131e7e30de
MD5 54a8199b3feac107dfa9e96bc5249fb5
SHA1 990382a65f538ab30e0d5acfb641d75a4dc05111
SHA512 5fab309ec112787aa815f1083ca4a79964805c9d79f705836571ad43e793002e645cd374b5d222d2714d4805b40861f4af763da42fde0403bf496fd095b574e8
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eo:87JymFwnIudbbnw1R9dwndwQ3tnnZv3Q
TLSH
T16673EDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 73KB
SHA256 0f0a06ab9441484a055b1ca61546694fef0be62e2cd16d1594d1ba80cb59850c
MD5 2df0543188b7a8f0eb30c17ea0ae9c31
SHA1 69bc2e589209302b1d72f320705a7a34cb7ca4f4
SHA512 32423645df3fd857c67957df09caf6c6a2e81795dab7bf7dd32585fb3093a87bdc9cc8d914a3b513d0b585acf6f748c21789467883fbeee49d4deba4c9158c5e
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eE:87JymFwnIudbbnw1R9dwndwQ3tnnZv3c
TLSH
T11673ECD4C4826C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 7KB
SHA256 1e77056a3c4095ada4fcda89fd15d3eaf975f5160ee6bae50cd3c609a2e50079
MD5 5ff827bca98f2d3beb555925e967ea1d
SHA1 3a8f3c03fa8ebf1a54072ceb83c0c157c13b7f34
SHA512 6d54837c8ca8e3700cb957f8fd004f28221b59dbae46ec1781f5adf41e4a88bcfe57f369b0125ef1302bacfaece0d4360ebca19b08bc12a7aeb72954791a5ccd
SSDEEP 192:0TSm9S2S3RzoFRcS3RzoFR5YZSmDSPSwKlSa4lS3RzoNgRcllS3RzoNgRc9bSgbd:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwi6
TLSH
T1B9F1CFD8C4816D9BE78F304EC79501D51B6FA8CA59F210264A3F7E9690EE18DC3E7826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 76KB
SHA256 66ba800d9c8afe037eea7e9f2723b18816e054ef5d27a207cdbf9bd887efc31f
MD5 adf6e5682f427f72d330ac2a81ac084d
SHA1 c88424a7bb9ecbec96188a43a16cf8889a0d275e
SHA512 dd7dc476287d5bfb3de3c266dd1dd271b584f36caa088b1161bcda0c507c26cec4b1c5de8103f0682e421f985aecea00f2c217f1517b4ff09597d0c9617e412e
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eW:87JymFwnIudbbnw1R9dwndwQ3tnnZv3e
TLSH
T14973DCD4C4826C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 77KB
SHA256 6598f1b11268f31ed326b595da12ed1c69d47d36e8e5db95fa38f3cb8d372533
MD5 e8e62dfdd135595dd852d7a31e39ea61
SHA1 573c868b93f00d30bf00706bba60ffb11d5746df
SHA512 3a34cde47bae9813fe3546d4dd1450e9ba9fe8d14762d3f7f7f0a3c432688be7bfe8f6da43327f1f3c2b1ff4ba1decd875e667736f045755e6bc6dc516b771fb
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eV:87JymFwnIudbbnw1R9dwndwQ3tnnZv3d
TLSH
T11773ECD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 79KB
SHA256 ad2df75e427911e3aad5f5e1620e79a1e4e44022c5ae1666a2c5609228afc71c
MD5 40d23c78d4d93c24fe10007465ac025c
SHA1 035614e796dddad82286a29ac02471139064d1fe
SHA512 53e0b7a49128c23560fd4fd5482db379852744501fce48a7667fb260eb80dfaafba9c0c94c5afe737f45601e640ad84890fc023e1cd6d35b80800532b321aa47
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e9:87JymFwnIudbbnw1R9dwndwQ3tnnZv31
TLSH
T12883ECD8C4816C5FDB8F700ECB9511D41B9F9DCA59E210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 80KB
SHA256 096dba38d08e74071613dad76228575789aaf7611c0104c66080b0f4df107b8c
MD5 8534e0d26025e62b4dd5dd1785990a33
SHA1 74e09e22fd66262a07f3ac23a166479b548882f3
SHA512 b0c39d0c63478c1fc181f8099d0d65d77e4cef9ae6aaf4e1a6e48cbea791b5e053c3e1484d2d239e58ca1bef7e36038eb891849dac80bea805cb7ccadc8b576e
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eH:87JymFwnIudbbnw1R9dwndwQ3tnnZv3P
TLSH
T13A83DCD8C4816C5FDB8F700ECB9511D41B9F9DCA59E210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 82KB
SHA256 5e15e9615c0987495adfa4c1fe7a155bb491d689c3436799acff57f8bac07207
MD5 2204fe11970b0f3d99b9d9d0afed1ba6
SHA1 90000d734c2d690aebfb33379d358f300378bba3
SHA512 d9f13f1dd87d560931415be4d0818d5afb9120a763e3db365831c287caa8f7910161397de0d144183a918039452d990130e941d0c7b02df989709cad6e8e2877
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eS:87JymFwnIudbbnw1R9dwndwQ3tnnZv36
TLSH
T1A383DCD8C4816C5FDB8F700ECB9511D41B9F9DCA59E210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 83KB
SHA256 6b8a4eb57aeb3c8cc5c2e755bcf524f01eee8099c04318e86d88c2110f05af5b
MD5 cb6239f8455183a8f3aec6d8b41f6ae0
SHA1 2ea76c56bbe34ef6f22e2520a1fb82204901e825
SHA512 04b4ff16e59c8a052110deb16f23be3ef02049da230397f95a9a8e4b7d9e575e6eb588d97f9ba90a2baf01fc0f6a9f94bea39d24ea7cdaa1a88881e2648f4c12
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e5:87JymFwnIudbbnw1R9dwndwQ3tnnZv3h
TLSH
T1B083DCD8C4816C5FDB8F700ECB9511D41B9F9DCA59E210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 85KB
SHA256 9bf520e39256aa17591d1dbd6194840059fefff547e9591c02250e989f4634d0
MD5 8c810778db95e0be32682e1a179817cb
SHA1 346c325a6c8c1ccb22c4348c6d6f0e21a56c5d37
SHA512 6f90b4b05d856d492eba65755b6eef88cdf033a1d3a11898341371cab8c39fabe88ff4b73eed1b5032354110790b39ca73253722fff61e24bbc58440d0567e25
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e8:87JymFwnIudbbnw1R9dwndwQ3tnnZv30
TLSH
T14E83ECD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 87KB
SHA256 eb3fa789c410346570366dea7090561fe8175ee56362c5d334fbc73b5f378f71
MD5 1786454a1ee23e90bcd3485cec344292
SHA1 7fc376fb5c1af5739185c46edd1585329a606c22
SHA512 f07ba2eb2d898950d818963a2b6c588fa80cf1880d657f5eb92f7be6a11d69c8e68a653dc4bcd47ac2f9af68c03f6990c34b6239f1c98c032fa7fcc33da315a4
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eq:87JymFwnIudbbnw1R9dwndwQ3tnnZv3i
TLSH
T1B393EDD8C4816C5FDB8F700ECB9511D41B9F9DCA59E210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 88KB
SHA256 a5937b98cc35038be9f265e18ec586c42ccc6ab3571433ebb43ba2afb092f48c
MD5 a6cd20ab43d2c33e7a4ebfb55ecda916
SHA1 1d6a5af6b772bda2800deb7b0af04232d965e14f
SHA512 f26cc09cfadbd43b0c8b9718060b24b00a327234331f946ab1b57207655f3ea5bf5bd64746fd12ac856d355ef23aa8a36c257b43f9af68e2fa0257b4d3d4672c
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9e6:87JymFwnIudbbnw1R9dwndwQ3tnnZv3i
TLSH
T15693EDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 8KB
SHA256 40d3fcfad869252a38cd0be3da4d618cfd7bb9ecce764fb267095531621dc018
MD5 30073965032ca0360f9663d980ed49ad
SHA1 edf593d0f66aa4c56fa716bd41181cc86f03e5ce
SHA512 37666d6667009d5aba7f85d3958be874f0e0577e4eb0604ab6037a55eadc53798d7019cf648574c226b2f207c5396dc2be03989950abd5f1e0b7fbdbd51d6e19
SSDEEP 192:0TSm9S2S3RzoFRcS3RzoFR5YZSmDSPSwKlSa4lS3RzoNgRcllS3RzoNgRc9bSgb2:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiT
TLSH
T15112E0D8C0816D9FEB8F304ECB9511D51B5FA8CA59F21026093F7ED690AE18DC3E7866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 89KB
SHA256 1db4587257d79573167527b01cc45af216ef72a88fb6e659407ef1c2ba763395
MD5 1c03caa895e66db9fa9aca6283d8ee87
SHA1 3526b177e1350ce99c3dfe914bcfd1eb7f46d5f7
SHA512 7a044332ac074af574988cb5ce87c53414e1218d883e15ad9dd546df0169421f92cc0b124a3b5d8b093d20f1cf2d862c59277d74cfec71cdf63771278e95c78f
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9ey:87JymFwnIudbbnw1R9dwndwQ3tnnZv36
TLSH
T11093FDD8C4816C5BDB8F700ECB9501D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 91KB
SHA256 8d19e0a0366c75c3bb0d3e58d626bb0b69716bf7d245a08c518daa24db3d1910
MD5 e82cf6b7807b43fb9cdc85fb7ce8552d
SHA1 706af2471c6129f23628009e0839882d2cbbd5a4
SHA512 e82c37c47ce60bb15f3a812550d35513795c5370f5a35e2f1a2654ba6b750d873d644d17b47342e42283da1424c2fcb8e7615a44e89949368131499dcc4bb272
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eM:87JymFwnIudbbnw1R9dwndwQ3tnnZv30
TLSH
T14D93EDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 92KB
SHA256 bf87b93c59b7e8a6a13cabf6c00d9d83bab676c7ea62af2cdf4d25ff1d34c38b
MD5 2d0141f676f5de4a7fbfadc4afa245e9
SHA1 7d02f7bf114a2f9caa680834b08b3640a0db6dda
SHA512 de93436e7a3df7077c7deba8817b72aae9a8af03d95ef08ac3f2f8c59e3f18f152cd471ea437d2f76975a678fddc4f5c0bf89fb2f112a4925379468d22d5e850
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eY:87JymFwnIudbbnw1R9dwndwQ3tnnZv3g
TLSH
T15493FDD8C4816D5BDB8F700ECB9501D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 95KB
SHA256 9817e436b6e37d22eb226c3064207ea4036e564e64af0aa68f64b13a82e59e80
MD5 48efdc6bd15fc37faf51a70a9b7f0120
SHA1 a6d15eeeab0df6592ad431382f2c148014faf4ad
SHA512 b1f812c8cb631f415715bf02a3506ef6661394395227290e06852a8d537834be5596bba026d7222140f0e3f38619556a5eebe8b90368607b7539a29f61f4b79e
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eM:87JymFwnIudbbnw1R9dwndwQ3tnnZv3U
TLSH
T184A3FDD8C4816C5BDB8F700ECB9501D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 95KB
SHA256 cfbac2d1eddee9a655e89d75e61e3dc88a9ea1459b1429a7cd5444254be29dd7
MD5 7cc35f6e61b62d1533385e906862fdfe
SHA1 c5a9d64a58b5bfada955902890dcdaee25d49a7b
SHA512 98db5e0bcbcaa88e8de46fd6759ea09761447ce3d62a793adeeb48d7fb9b0072eb3fbea50f491b8b654d7d0a91ac8987727443d49b66798b5d66e476d13ac25d
SSDEEP 1536:899Jym9DwnIudbbnw9DR9dwnd9qQ3tnnZ9Z3znbD99evYxgny9xM3zQni9k4j9eJ:87JymFwnIudbbnw1R9dwndwQ3tnnZv3B
TLSH
T1C9A3FDD8C4816D5BDB8F700ECB9501D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 97KB
SHA256 29f29b21e7d4be97b74c38bb3857bf09142998b4bcd6d0a2227cb2b56e663f28
MD5 0c54cb38cc828a7320420a95843f9b1b
SHA1 e62fce99dd59814669c0649aefeb9709a9972e10
SHA512 4a04554adaf7db26e26def42163620365b95f9d36d5e0e8888076c3c639ef50e03c28ba731c49eba069caa5c9c71052e25ce46b3016f33aa63948ff7cc7b24e2
SSDEEP 3072:87JymFwnIudbbnw1R9dwndwQ3tnnZv3znbD9kvYxgnyDM3zQni24jgCn4p0O3Vnq:d7LXdKIw8cGjR793ThR0W1Yswdgsg1ZS
TLSH
T1B7A3FDD8C4816C5BDB8F700ECB9511D41B9F9DCA59F210620A3FBED6A0AE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 10KB
SHA256 333a385e58ef9878f2743ecd805b9d082d8a0f2257a3640a3f38c12803ce64b4
MD5 6da130fac469c308b113c2b5953804cb
SHA1 8a3390f492cb707aedf8a742e80ce59a52e34c68
SHA512 51ae6edb83572d53738324e6eb733b44b8ae76a79145ecb39e465e822973e35807478d96af09953c73244eabb1627c0b9c86e065a62b05f9b8b7924bc2f5e077
SSDEEP 192:0TSm9S2S3RzoFRcS3RzoFR5YZSmDSPSwKlSa4lS3RzoNgRcllS3RzoNgRc9bSgbV:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwig
TLSH
T1E922F0D8C0816D8BEB8F304ECB9511D41B5FADCA55F210260A3FBE9690EE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 11KB
SHA256 c61b8c3b88e4226a574377f78562c0ac3ab70d37c6f53ae5a11c4cb872ad02e9
MD5 b5ea895bc4c3f0c26ec399bf54e33450
SHA1 eed207e18ad6c61764bdd1b8a2109935c6fc1853
SHA512 d7127419aca37ff554c7e894c620f9701e82e38ae712da281696f7c9fbbc130fe0029cc5358fbb43bbc46b110ecfd486cc67e19c0853d6073c23f205349881e0
SSDEEP 192:0TSm9S2S3RzoFRcS3RzoFR5YZSmDSPSwKlSa4lS3RzoNgRcllS3RzoNgRc9bSgbu:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiv
TLSH
T12042E1D8C0816D9BEB8F300ECB9511D41B5FADCA55F210660A3FBE9690EE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 13KB
SHA256 e6f7cf81188b7f8115b3e0fc4ed04d68dde990c37e8a2eb11a08cf1c507efac5
MD5 92b7988852ba282b53c39bde3f0b0080
SHA1 a6ba14daeed5609a7f2ff309568e525071a32f41
SHA512 a2152d5c92660d82fed9a7ce6abc6705c705d99a4f75f77aa919d77e92a69ecc81d187d6825b57b158bd95ef5e3650001f59dffd54bcaac84c07243643aaf8f0
SSDEEP 384:0TSm9S2SLS+6SmDSPSwISVSoSSSgSwiZSmDS6S8SUSbSwioSmqSjSaSYSQSwi2Sy:899Jym9DwnIudbbnw9DR9dwnd9qQ3tn7
TLSH
T16352E0D8C4816C9BEB8F300ECB9511D41B5F9DCA59F210660A3FBE9690EE18DC3E7856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download