Analysis

  • max time kernel
    151s
  • max time network
    99s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    07-07-2020 10:00

General

  • Target

    Swift.exe

  • Size

    241KB

  • MD5

    459f63adf5cd96b5af7c2ef4393253fa

  • SHA1

    7d73ef4b14ace3f13bca5edc739ae405664bec20

  • SHA256

    ad8c070c48103dbc11875a052aa0447395f6ddda11e3f9e8aed091f0bb14050d

  • SHA512

    4456749f9913ad2dacf689a2ee616b2f9929e95767fedd39dcfdef75fe383227d2d0cbb58218ec3bee9db7d070f5b02c7c5abac2a79f1f7d4a740ab491076317

Malware Config

Signatures

  • Suspicious use of SendNotifyMessage 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Adds Run entry to start application 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 1156 IoCs
  • Suspicious use of SetThreadContext 152 IoCs
  • Suspicious use of AdjustPrivilegeToken 190 IoCs
  • Suspicious behavior: EnumeratesProcesses 15492 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: MapViewOfSection 294 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Checks whether UAC is enabled
    • Suspicious use of FindShellTrayWindow
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1496
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1820
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:1804
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: MapViewOfSection
            PID:1824
          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: MapViewOfSection
            PID:1860
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: MapViewOfSection
              PID:1896
            • C:\Users\Admin\AppData\Local\Temp\Swift.exe
              "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: MapViewOfSection
              PID:1928
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious behavior: MapViewOfSection
                PID:2028
              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                5⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious behavior: MapViewOfSection
                PID:1040
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious behavior: MapViewOfSection
                  PID:1776
                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                  6⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious behavior: MapViewOfSection
                  PID:1652
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    PID:1564
                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    PID:1312
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      8⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious behavior: MapViewOfSection
                      PID:1572
                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                      8⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious behavior: MapViewOfSection
                      PID:768
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        9⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        PID:1580
                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                        9⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        PID:1840
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          10⤵
                            PID:1804
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            10⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious behavior: MapViewOfSection
                            PID:1912
                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                            10⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious behavior: MapViewOfSection
                            PID:1996
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              11⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              PID:2032
                            • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                              "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                              11⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              PID:932
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                12⤵
                                  PID:2024
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  12⤵
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious behavior: MapViewOfSection
                                  PID:1636
                                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                  12⤵
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious behavior: MapViewOfSection
                                  PID:1952
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    13⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious behavior: MapViewOfSection
                                    PID:2044
                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                    13⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious behavior: MapViewOfSection
                                    PID:1408
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      14⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious behavior: MapViewOfSection
                                      PID:1112
                                      • C:\Windows\SysWOW64\ipconfig.exe
                                        "C:\Windows\SysWOW64\ipconfig.exe"
                                        15⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1840
                                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                      14⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious behavior: MapViewOfSection
                                      PID:1320
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        15⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1844
                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                        15⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1052
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          16⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious behavior: MapViewOfSection
                                          PID:1568
                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                          16⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious behavior: MapViewOfSection
                                          PID:1520
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            17⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious behavior: MapViewOfSection
                                            PID:1336
                                            • C:\Windows\SysWOW64\control.exe
                                              "C:\Windows\SysWOW64\control.exe"
                                              18⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1968
                                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                            17⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1584
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              18⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1812
                                            • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                              18⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:332
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                19⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1964
                                                • C:\Windows\SysWOW64\autochk.exe
                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                  20⤵
                                                    PID:2024
                                                  • C:\Windows\SysWOW64\wscript.exe
                                                    "C:\Windows\SysWOW64\wscript.exe"
                                                    20⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1788
                                                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                  19⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1788
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    20⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:108
                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                    20⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1684
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      21⤵
                                                        PID:1476
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        21⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1524
                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                        21⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1056
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          22⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:568
                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                          22⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:672
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            23⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1460
                                                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                            23⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1332
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              24⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1880
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                "C:\Windows\SysWOW64\svchost.exe"
                                                                25⤵
                                                                  PID:1804
                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                24⤵
                                                                • Suspicious use of SetThreadContext
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2012
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  25⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1160
                                                                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                  25⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1976
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    26⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:1608
                                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                    26⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:1644
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      27⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:1632
                                                                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                      27⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:1780
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        28⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:2020
                                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                        28⤵
                                                                          PID:1468
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            29⤵
                                                                              PID:688
                                                                            • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                              29⤵
                                                                                PID:1840
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  30⤵
                                                                                    PID:304
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                    30⤵
                                                                                      PID:1200
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        31⤵
                                                                                          PID:1040
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                          31⤵
                                                                                            PID:1360
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              32⤵
                                                                                                PID:1832
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                32⤵
                                                                                                  PID:796
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    33⤵
                                                                                                      PID:1444
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                      33⤵
                                                                                                        PID:1996
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          34⤵
                                                                                                            PID:1788
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                            34⤵
                                                                                                              PID:1180
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                35⤵
                                                                                                                  PID:1072
                                                                                                                  • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                    "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                    36⤵
                                                                                                                      PID:1360
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                    35⤵
                                                                                                                      PID:1940
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                        36⤵
                                                                                                                          PID:1612
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                          36⤵
                                                                                                                            PID:1804
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              37⤵
                                                                                                                                PID:1364
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                37⤵
                                                                                                                                  PID:1856
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    38⤵
                                                                                                                                      PID:1996
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                      38⤵
                                                                                                                                        PID:1032
                                                                                                                                        • C:\Windows\SysWOW64\systray.exe
                                                                                                                                          "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                          39⤵
                                                                                                                                            PID:1036
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                          38⤵
                                                                                                                                            PID:552
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              39⤵
                                                                                                                                                PID:1260
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                39⤵
                                                                                                                                                  PID:1036
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                    40⤵
                                                                                                                                                      PID:1740
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                      40⤵
                                                                                                                                                        PID:1644
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                          41⤵
                                                                                                                                                            PID:1696
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                            41⤵
                                                                                                                                                              PID:964
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                42⤵
                                                                                                                                                                  PID:1936
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                  42⤵
                                                                                                                                                                    PID:536
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      43⤵
                                                                                                                                                                        PID:1508
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                        43⤵
                                                                                                                                                                          PID:1232
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                            44⤵
                                                                                                                                                                              PID:784
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:1080
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                44⤵
                                                                                                                                                                                  PID:1176
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    45⤵
                                                                                                                                                                                      PID:1180
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                      45⤵
                                                                                                                                                                                        PID:432
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          46⤵
                                                                                                                                                                                            PID:1916
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                            46⤵
                                                                                                                                                                                              PID:1408
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                47⤵
                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                    PID:1932
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                              PID:2188
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                PID:2196
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                  PID:2232
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                        51⤵
                                                                                                                                                                                                                          PID:2840
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                              PID:2388
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                              PID:432
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                              PID:2552
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                  PID:2596
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                PID:2860
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                    PID:2896
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                        PID:2972
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                              PID:3056
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                            PID:2132
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                PID:2372
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                        PID:2476
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                PID:2420
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                  PID:2416
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Swift.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Swift.exe"
                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                        PID:2964
                                                                                                                                                                                                      • C:\Windows\SysWOW64\wininit.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\wininit.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                        • Adds Run entry to start application
                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                        PID:1396
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2004
                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:1100
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:1648
                                                                                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:240
                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:588
                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:332
                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:772
                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:568
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1660
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:872
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:1808
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:1868
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:1860
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:1768
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                              PID:532
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:568
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1104
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:872
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1492
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1048
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1592
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1596
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1584
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:1652
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1900
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1800
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:832
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1840
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1200
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:108
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:2024
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2020
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1700
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1780
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:456
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1604
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:472
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1068
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:1436
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:1892
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            PID:892
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1356
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1604
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1856
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1932
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1996
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:1840
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:1664
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:1504
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:1780
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1740
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1972
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2024
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1484
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:304
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:796
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:472
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:524
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1508
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1484
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1888
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1904
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wininit.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\wininit.exe"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1872
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1780
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1708
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1548
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1604
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:560
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1856
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:796
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:320
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:524
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:852
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2652

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/240-29-0x0000000000580000-0x0000000000586000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/432-305-0x0000000000C80000-0x0000000000CA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/456-67-0x00000000003F0000-0x0000000000408000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/472-225-0x0000000000610000-0x0000000000628000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/532-57-0x0000000000700000-0x0000000000707000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/536-239-0x00000000011E0000-0x00000000011EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/560-191-0x0000000000F80000-0x0000000000F85000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/748-341-0x0000000000A70000-0x0000000000A88000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/784-315-0x0000000000920000-0x0000000000926000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/852-218-0x0000000000DD0000-0x0000000000DE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/892-121-0x0000000000860000-0x0000000000867000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/932-328-0x0000000000990000-0x0000000000999000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1036-220-0x0000000000470000-0x0000000000475000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1068-233-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1100-18-0x0000000000EF0000-0x0000000000F04000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1124-78-0x0000000000730000-0x0000000000736000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-326-0x000000000E300000-0x000000000E41B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-130-0x000000000ABC0000-0x000000000ACAD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  948KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-297-0x000000000DD40000-0x000000000DE67000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-278-0x000000000D7A0000-0x000000000D863000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  780KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-189-0x000000000BC90000-0x000000000BD51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  772KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-277-0x000000000D650000-0x000000000D795000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-89-0x0000000009E00000-0x0000000009F43000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-303-0x000000000DE70000-0x000000000DF46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  856KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-309-0x000000000DF50000-0x000000000E090000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-93-0x000000000A060000-0x000000000A192000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-136-0x000000000ADE0000-0x000000000AF71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-273-0x000000000D250000-0x000000000D325000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  852KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-259-0x000000000CD10000-0x000000000CE35000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-186-0x000000000BB00000-0x000000000BC8D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-250-0x000000000CBC0000-0x000000000CD08000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-180-0x000000000B9A0000-0x000000000BAF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-101-0x000000000A270000-0x000000000A39D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-161-0x000000000B400000-0x000000000B598000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-339-0x000000000D420000-0x000000000D4DA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  744KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-144-0x000000000AF80000-0x000000000B065000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  916KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-237-0x000000000C8D0000-0x000000000CA4B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-107-0x000000000A3A0000-0x000000000A49D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1012KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-152-0x000000000B070000-0x000000000B18A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-345-0x000000000E500000-0x000000000E5D9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  868KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-110-0x000000000A4A0000-0x000000000A624000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-269-0x000000000D0F0000-0x000000000D24F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-206-0x000000000C0F0000-0x000000000C24A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-114-0x000000000A630000-0x000000000A758000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-195-0x000000000BD60000-0x000000000BEB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-293-0x000000000DC00000-0x000000000DD31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1268-265-0x000000000CE40000-0x000000000CF9A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1320-148-0x0000000000E40000-0x0000000000E5B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1360-200-0x0000000000D20000-0x0000000000D38000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1396-251-0x0000000003180000-0x0000000003272000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  968KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1396-7-0x00000000009F0000-0x0000000000A0A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1396-22-0x0000000001E10000-0x0000000001F0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1016KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1436-97-0x00000000009E0000-0x0000000000C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1484-132-0x0000000000E60000-0x0000000000E6D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1548-173-0x0000000000630000-0x000000000063D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1556-184-0x0000000000330000-0x000000000033A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1576-126-0x0000000000D30000-0x0000000000D56000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1604-182-0x0000000000420000-0x0000000000434000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1648-24-0x0000000000B50000-0x0000000000B6B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1652-62-0x0000000000640000-0x0000000000658000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1708-168-0x00000000000E0000-0x00000000000F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1768-52-0x0000000000CA0000-0x0000000000D94000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  976KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1780-163-0x00000000007D0000-0x00000000007F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1788-109-0x0000000000920000-0x0000000000946000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1804-140-0x0000000000D80000-0x0000000000D88000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1804-213-0x00000000002D0000-0x00000000002DB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1808-40-0x000000004A5E0000-0x000000004A62C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1824-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1836-202-0x0000000000F60000-0x0000000000F78000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1840-80-0x0000000000A60000-0x0000000000A6A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1860-47-0x0000000000BD0000-0x0000000000BF6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1868-42-0x0000000000F80000-0x0000000000F85000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1888-138-0x00000000006F0000-0x00000000006F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1892-106-0x0000000000470000-0x000000000048F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1944-85-0x0000000000BB0000-0x0000000000BBD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1960-13-0x0000000000070000-0x000000000007D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1968-95-0x00000000004C0000-0x00000000004DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1968-119-0x0000000000250000-0x0000000000256000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1976-244-0x0000000000B90000-0x0000000000BAB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1996-208-0x00000000003B0000-0x00000000003C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2056-246-0x0000000000A40000-0x0000000000A46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2072-253-0x000000013FD40000-0x000000013FDD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2156-317-0x0000000000130000-0x000000000013D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2164-255-0x0000000000A50000-0x0000000000CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2208-322-0x0000000000A60000-0x0000000000A74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2248-335-0x00000000006D0000-0x00000000006DA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2268-261-0x0000000000A60000-0x0000000000B54000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  976KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2312-330-0x00000000003B0000-0x00000000003C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2500-347-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2608-283-0x0000000000390000-0x000000000039D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2680-290-0x0000000000550000-0x0000000000564000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2812-352-0x0000000000CF0000-0x0000000000CFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2820-292-0x00000000000D0000-0x00000000000DB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2840-285-0x0000000000B20000-0x0000000000B25000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2944-299-0x00000000006E0000-0x00000000006F6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88KB