Overview

overview

10

Static

static

7000d01e77...c3.exe

windows7_x64

10

7000d01e77...c3.exe

windows10_x64

10

Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09/11/2020, 20:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7000d01e779b7b2765741e61b74dfac3.exe
  • Size 578KB
  • Sample201109-57w2drk4b6
  • SHA256 c21ee6cfa09a79362a7f3b03781a7f252d10b41da48dea433e06fe4a0df26eee
  • MD5 SHA1 SHA512
Score
10/10
nanocorekeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • mogs20.hopto.org:1122

  • 185.140.53.208:1122

Mutex

  • 56f44fe1-ce1b-40b6-a585-5b57c26993fa

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    185.140.53.208

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-03-07T22:55:03.830718736Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    1122

  • default_group

    NASIRUUU

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    56f44fe1-ce1b-40b6-a585-5b57c26993fa

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    mogs20.hopto.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 71 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19100 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 93 IoCs
  • Suspicious use of AdjustPrivilegeToken 72 IoCs
  • Suspicious use of WriteProcessMemory 560 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:3528
    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
      2⤵
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3792
        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3600
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:4000
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:4048
              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3776
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:3620
                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                    5⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1336
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:2708
                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                        6⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3960
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          7⤵
                            PID:576
                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1180
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              8⤵
                                PID:668
                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                8⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3328
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  9⤵
                                    PID:3080
                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                    9⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2624
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      10⤵
                                        PID:3504
                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                        10⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2344
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          11⤵
                                            PID:580
                                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                            11⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:496
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              12⤵
                                                PID:3844
                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                12⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2316
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  13⤵
                                                    PID:3188
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    13⤵
                                                      PID:912
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      13⤵
                                                        PID:3864
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        13⤵
                                                          PID:2236
                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                          13⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3716
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            14⤵
                                                              PID:3520
                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                              14⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious behavior: MapViewOfSection
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1140
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                15⤵
                                                                  PID:2440
                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                  15⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3680
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    16⤵
                                                                      PID:3096
                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                      16⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4032
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        17⤵
                                                                          PID:2944
                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                          17⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3248
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            18⤵
                                                                              PID:3372
                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                              18⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3992
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                19⤵
                                                                                  PID:1144
                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                  19⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3472
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                    20⤵
                                                                                      PID:2304
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                      20⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3768
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        21⤵
                                                                                          PID:3944
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                          21⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1292
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                            22⤵
                                                                                              PID:3948
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                              22⤵
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2332
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                23⤵
                                                                                                  PID:2136
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                  23⤵
                                                                                                    PID:2120
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                    23⤵
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3688
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                      24⤵
                                                                                                        PID:3860
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        24⤵
                                                                                                          PID:3288
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                          24⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:3424
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                            25⤵
                                                                                                              PID:1588
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                              25⤵
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2616
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                26⤵
                                                                                                                  PID:3932
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                  26⤵
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4068
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                    27⤵
                                                                                                                      PID:2212
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      27⤵
                                                                                                                        PID:1948
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                        27⤵
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2400
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                          28⤵
                                                                                                                            PID:2296
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                            28⤵
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1340
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              29⤵
                                                                                                                                PID:3748
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                29⤵
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1928
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  30⤵
                                                                                                                                    PID:3840
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                    30⤵
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2704
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                      31⤵
                                                                                                                                        PID:2948
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                        31⤵
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4016
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          32⤵
                                                                                                                                            PID:492
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                            32⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:3828
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              33⤵
                                                                                                                                                PID:804
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                33⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:1748
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                  34⤵
                                                                                                                                                    PID:1400
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                    34⤵
                                                                                                                                                      PID:1444
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                      34⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:3984
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        35⤵
                                                                                                                                                          PID:1492
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                          35⤵
                                                                                                                                                            PID:1392
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                            35⤵
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3024
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                              36⤵
                                                                                                                                                                PID:3820
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                36⤵
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:3624
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                  37⤵
                                                                                                                                                                    PID:1324
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                    37⤵
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:3176
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      38⤵
                                                                                                                                                                        PID:2272
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                        38⤵
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:1280
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                          39⤵
                                                                                                                                                                            PID:3980
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                            39⤵
                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2580
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                              40⤵
                                                                                                                                                                                PID:2308
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                40⤵
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:3204
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                  41⤵
                                                                                                                                                                                    PID:3340
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    41⤵
                                                                                                                                                                                      PID:636
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                      41⤵
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:2576
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                        42⤵
                                                                                                                                                                                          PID:1812
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                          42⤵
                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:3968
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                            43⤵
                                                                                                                                                                                              PID:3704
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                              43⤵
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1260
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                44⤵
                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:2660
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                      PID:2204
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                        46⤵
                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:3584
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                              PID:416
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:3368
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                      PID:3208
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:744
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                          PID:1728
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:632
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                PID:188
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                          PID:4400
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:4668
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                              PID:5040
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                  PID:4204
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                      PID:2360
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                        PID:3192
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:4468
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:4860
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                    PID:4992
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                PID:5100
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                PID:1060
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                        PID:4296
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                              PID:5112
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7000d01e779b7b2765741e61b74dfac3.exe"
                                                                                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4488
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                      72⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4500

                                                                                                                                                                                                        Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              memory/188-715-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/416-658-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/492-445-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/496-153-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/500-0-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/500-3-0x00000000056F0000-0x0000000005771000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/500-1-0x0000000000D50000-0x0000000000D51000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/576-88-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/580-145-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/632-708-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/636-574-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/668-102-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/744-694-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/804-459-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1016-1198-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1140-198-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1144-260-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1180-96-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1260-610-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1280-539-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1292-296-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1324-517-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1336-68-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1340-397-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1392-489-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1444-474-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1480-1028-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1588-346-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1708-638-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1728-700-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1748-467-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1812-588-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1828-1170-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1928-411-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/1948-375-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2120-317-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2204-630-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2236-176-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2272-531-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2296-389-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2304-274-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2308-559-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2316-167-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2332-310-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2344-139-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2384-810-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2400-383-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2440-204-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2444-644-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2576-582-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2580-553-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2616-354-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2624-125-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2660-624-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2700-925-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2704-425-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2708-74-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2856-968-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2944-232-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2948-431-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/2956-13-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3008-680-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3024-497-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3080-117-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3096-218-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3176-525-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3192-831-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3204-567-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3208-686-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3248-240-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3288-332-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3328-110-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3344-616-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3364-672-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3368-666-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3372-246-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3424-340-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3472-268-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3504-131-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3520-190-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-34-0x00000000061F0000-0x0000000006205000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-50-0x0000000006750000-0x0000000006779000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-42-0x0000000006360000-0x000000000636A000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-29-0x0000000005AA0000-0x0000000005AA5000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-10-0x00000000055B0000-0x00000000055B1000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-4-0x0000000000400000-0x000000000047E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-11-0x0000000005650000-0x0000000005651000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-32-0x00000000061E0000-0x00000000061ED000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-51-0x00000000063B0000-0x00000000063BF000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-40-0x0000000006330000-0x000000000633F000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-17-0x0000000005550000-0x0000000005551000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-39-0x0000000006320000-0x0000000006326000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-9-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-46-0x00000000063A0000-0x00000000063A3000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-43-0x0000000006370000-0x0000000006389000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3528-6-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3584-652-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3600-36-0x0000000006300000-0x000000000637E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3600-28-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3620-60-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3624-511-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3680-212-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3688-325-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3704-602-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3708-1118-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3716-184-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3748-403-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3768-282-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3776-54-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3792-20-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3820-503-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3828-453-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3840-417-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3844-159-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3932-360-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3944-288-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3948-302-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3960-82-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3968-596-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3976-895-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3980-545-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3984-482-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/3992-254-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4016-439-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4032-226-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4048-41-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4068-368-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4112-824-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4116-1098-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4144-1190-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4164-723-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4184-845-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4204-816-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4232-729-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4248-1090-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4296-960-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4312-1162-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4320-737-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4364-917-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4368-1005-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4380-1154-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4384-859-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4416-1034-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4420-1042-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4424-746-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4440-1104-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4448-982-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4452-903-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4468-839-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4500-1020-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4516-754-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4540-1146-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4544-1112-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4552-1056-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4560-990-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4564-760-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4584-1076-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4608-939-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4612-946-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4636-873-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4644-1132-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4668-768-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4680-1140-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4684-853-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4696-1048-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4720-774-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4748-931-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4800-1062-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4828-782-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4852-1013-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4856-1126-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4860-867-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4876-788-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4888-974-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4932-1070-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4968-1176-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4984-796-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/4992-881-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5040-802-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5048-1184-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5076-1204-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5080-954-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5084-887-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5088-1084-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5100-911-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download

                                                                                                                                                                                                              memory/5108-998-0x0000000073190000-0x000000007387E000-memory.dmp
                                                                                                                                                                                                              Download