Analysis

  • max time kernel
    150s
  • max time network
    9s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22-01-2021 06:24

General

  • Target

    TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE

  • Size

    530KB

  • MD5

    d40d97b41a353bc42b0e7ebe451886d9

  • SHA1

    8e416c76489782a32eade1b03bcd26dce3f19a82

  • SHA256

    23b46a12d6b6a703b8e588d24f3c0018cf749556b021b514b963587e7adaa25b

  • SHA512

    85d6c292351f8ff836337c9ace1c38e3f65cb15268d160c9f5e5f8f52ee7284834fa1c4a022bc58204664cf35ea348b802ff01d3f0d2b64b56b6bd4eb963c65d

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 117 IoCs
  • Suspicious use of WriteProcessMemory 1031 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
      2⤵
        PID:1740
      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
          3⤵
            PID:1700
          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
            3⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
              4⤵
                PID:608
              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                4⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:1420
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                  5⤵
                    PID:1152
                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                    5⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of WriteProcessMemory
                    PID:1600
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                      6⤵
                        PID:1688
                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                        6⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of WriteProcessMemory
                        PID:1632
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                          7⤵
                            PID:1640
                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                            7⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of WriteProcessMemory
                            PID:1572
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                              8⤵
                                PID:812
                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                8⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of WriteProcessMemory
                                PID:1080
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                  9⤵
                                    PID:432
                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                    9⤵
                                    • Suspicious behavior: MapViewOfSection
                                    PID:296
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                      10⤵
                                        PID:1512
                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                        10⤵
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1196
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                          11⤵
                                            PID:968
                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                            11⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:1584
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                              12⤵
                                                PID:912
                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                12⤵
                                                • Suspicious behavior: MapViewOfSection
                                                PID:1036
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                  13⤵
                                                    PID:676
                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                    13⤵
                                                    • Suspicious behavior: MapViewOfSection
                                                    PID:308
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                      14⤵
                                                        PID:1904
                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                        14⤵
                                                        • Suspicious behavior: MapViewOfSection
                                                        PID:1816
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                          15⤵
                                                            PID:892
                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                            15⤵
                                                            • Suspicious behavior: MapViewOfSection
                                                            PID:888
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                              16⤵
                                                                PID:384
                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                16⤵
                                                                • Suspicious behavior: MapViewOfSection
                                                                PID:1500
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                  17⤵
                                                                    PID:744
                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                    17⤵
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:2008
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                      18⤵
                                                                        PID:932
                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                        18⤵
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:1580
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                          19⤵
                                                                            PID:1180
                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                            19⤵
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            PID:1604
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                              20⤵
                                                                                PID:1744
                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                20⤵
                                                                                • Suspicious behavior: MapViewOfSection
                                                                                PID:1864
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                  21⤵
                                                                                    PID:1388
                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                    21⤵
                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                    PID:1528
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                      22⤵
                                                                                        PID:1368
                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                        22⤵
                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                        PID:1268
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                          23⤵
                                                                                            PID:1352
                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                            23⤵
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            PID:1680
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                              24⤵
                                                                                                PID:1660
                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                24⤵
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:1524
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                  25⤵
                                                                                                    PID:1628
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                    25⤵
                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                    PID:316
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                      26⤵
                                                                                                        PID:1096
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                        26⤵
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        PID:1100
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                          27⤵
                                                                                                            PID:432
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                            27⤵
                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                            PID:1092
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                              28⤵
                                                                                                                PID:1536
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                28⤵
                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                PID:1056
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                  29⤵
                                                                                                                    PID:768
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                    29⤵
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    PID:1284
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                      30⤵
                                                                                                                        PID:652
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                        30⤵
                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                        PID:748
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                          31⤵
                                                                                                                            PID:1196
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                            31⤵
                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                            PID:1000
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                              32⤵
                                                                                                                                PID:984
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                32⤵
                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                PID:1928
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                  33⤵
                                                                                                                                    PID:1036
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                    33⤵
                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                    PID:280
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                      34⤵
                                                                                                                                        PID:1468
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                        34⤵
                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                        PID:1576
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                          35⤵
                                                                                                                                            PID:2020
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                            35⤵
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            PID:548
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                              36⤵
                                                                                                                                                PID:1972
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                36⤵
                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                PID:972
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                  37⤵
                                                                                                                                                    PID:1712
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                    37⤵
                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                    PID:936
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                      38⤵
                                                                                                                                                        PID:2008
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                        38⤵
                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                        PID:1720
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                          39⤵
                                                                                                                                                            PID:1612
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                            39⤵
                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                            PID:1316
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                              40⤵
                                                                                                                                                                PID:268
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                40⤵
                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                PID:1728
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                  41⤵
                                                                                                                                                                    PID:1652
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                    41⤵
                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                    PID:1440
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                      42⤵
                                                                                                                                                                        PID:1808
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                        42⤵
                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                        PID:1360
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                          43⤵
                                                                                                                                                                            PID:1152
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                            43⤵
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            PID:1420
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:1688
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                44⤵
                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                PID:1684
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                  45⤵
                                                                                                                                                                                    PID:1640
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                    45⤵
                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                    PID:860
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                      46⤵
                                                                                                                                                                                        PID:812
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                        46⤵
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        PID:1532
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                          47⤵
                                                                                                                                                                                            PID:292
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                            47⤵
                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                            PID:528
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                              48⤵
                                                                                                                                                                                                PID:1536
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                48⤵
                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                    PID:768
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                        PID:652
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        PID:1232
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                            PID:968
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                PID:848
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                PID:912
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                    PID:1036
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                        PID:1904
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                            PID:2020
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                PID:1972
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                PID:1084
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                    PID:1712
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                        PID:2008
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                        PID:908
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                PID:268
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                    PID:1700
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                        PID:608
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                            PID:1152
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                PID:1688
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                    PID:1640
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                      PID:1432
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                          PID:812
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                          66⤵
                                                                                                                                                                                                                                                                            PID:1600
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                PID:432
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                  PID:1632
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                            PID:528
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                    PID:836
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                              PID:1196
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                PID:772
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                    PID:984
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                          PID:828
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                            PID:1820
                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                PID:784
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                      PID:676
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                        PID:308
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                            PID:1840
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                              PID:912
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1932
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1988
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                        PID:892
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                        79⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1112
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:384
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2012
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1204
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1996
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1712
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:856
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:908
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:316
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\TNT SHIPMENT AWB_IMAGE CI_FROM TNT AWB# 167095453_PDF_________.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1368

                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                        • memory/280-65-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/296-17-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/308-25-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/316-49-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/528-93-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/548-69-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/608-123-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/748-59-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/860-89-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/888-29-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/908-115-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/912-103-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/936-73-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/968-101-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/972-71-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1000-61-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1036-23-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1056-55-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1080-15-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1080-95-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1084-111-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1092-53-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1100-51-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1196-19-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1232-99-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1268-43-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1284-57-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1316-77-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1360-83-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1420-7-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1420-85-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1432-129-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1440-81-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1500-31-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1516-97-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1524-47-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1528-41-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1532-91-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1552-127-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1572-13-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1576-67-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1580-35-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1584-21-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1600-9-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1604-37-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1632-11-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1656-2-0x00000000765A1000-0x00000000765A3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                        • memory/1680-45-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1684-87-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1700-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1716-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1720-75-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1728-79-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1740-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1768-5-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1772-3-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1816-27-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1848-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1864-39-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1904-107-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1928-105-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1928-63-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/1996-109-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/2008-33-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                        • memory/2024-113-0x0000000000000000-mapping.dmp