Overview

overview

10

Static

static

DHL INTERN...BH.exe

windows7_x64

10

DHL INTERN...BH.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    152s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-02-2022 10:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DHL INTERNATIONAL GMBH.exe

  • Size

    798KB

  • MD5

    cb46aab04048194cea26e4ddedd3f10e

  • SHA1

    39ec5673efcfb1633cc5d96e115918ecdf317eca

  • SHA256

    6bd0bafbf71604a763081677bfa46355b40bc53d66fd70d46ce65b9232a273e5

  • SHA512

    a634679620d308add87d9bcf4ae56cf718baab8855afc4ff0aa7a4efe346d80dc94b466d9287499d8905beb3edfd958fe1ce7dfdf3f1a69df826ca17072f5a95

Score
10/10
hawkeye_rebornm00nd3v_loggercollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

  • Protocol:     smtp
  • Host:
    mail.bigmanstan.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @wealth$2020
Mutex

0328d550-8862-4359-a227-677f0e33ae61

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:@wealth$2020 _EmailPort:587 _EmailSSL:false _EmailServer:mail.bigmanstan.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:0328d550-8862-4359-a227-677f0e33ae61 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger Payload 3 IoCs

    Detects M00nD3v Logger payload in memory.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: SetClipboardViewer 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: SetClipboardViewer
      • Suspicious use of AdjustPrivilegeToken
      PID:1328
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:800
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 3
        3⤵
          PID:1180
      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: SetClipboardViewer
          • Suspicious use of AdjustPrivilegeToken
          PID:976
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:776
          • C:\Windows\SysWOW64\choice.exe
            choice /C Y /N /D Y /T 3
            4⤵
              PID:604
          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:788
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1848
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1212
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:752
              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1308
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • Accesses Microsoft Outlook profiles
                  • Suspicious behavior: SetClipboardViewer
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1356
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                  5⤵
                    PID:1560
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      6⤵
                        PID:1644
                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                      5⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1360
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • Accesses Microsoft Outlook profiles
                        • Suspicious behavior: SetClipboardViewer
                        • Suspicious use of AdjustPrivilegeToken
                        PID:868
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                        6⤵
                          PID:580
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 3
                            7⤵
                              PID:1544
                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                            6⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1712
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              7⤵
                              • Accesses Microsoft Outlook profiles
                              • Suspicious behavior: SetClipboardViewer
                              • Suspicious use of AdjustPrivilegeToken
                              PID:556
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                              7⤵
                                PID:1928
                                • C:\Windows\SysWOW64\choice.exe
                                  choice /C Y /N /D Y /T 3
                                  8⤵
                                    PID:1612
                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                  7⤵
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1504
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    8⤵
                                      PID:1520
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      8⤵
                                      • Suspicious behavior: SetClipboardViewer
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1840
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                      8⤵
                                        PID:1396
                                        • C:\Windows\SysWOW64\choice.exe
                                          choice /C Y /N /D Y /T 3
                                          9⤵
                                            PID:776
                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                          8⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1656
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            9⤵
                                            • Suspicious behavior: SetClipboardViewer
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:112
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                            9⤵
                                              PID:1708
                                              • C:\Windows\SysWOW64\choice.exe
                                                choice /C Y /N /D Y /T 3
                                                10⤵
                                                  PID:1524
                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                9⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:800
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  10⤵
                                                  • Accesses Microsoft Outlook profiles
                                                  • Suspicious behavior: SetClipboardViewer
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1824
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                  10⤵
                                                    PID:1720
                                                    • C:\Windows\SysWOW64\choice.exe
                                                      choice /C Y /N /D Y /T 3
                                                      11⤵
                                                        PID:1612
                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                      10⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious behavior: MapViewOfSection
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:804
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        11⤵
                                                          PID:836
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          11⤵
                                                          • Accesses Microsoft Outlook profiles
                                                          • Suspicious behavior: SetClipboardViewer
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1352
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                          11⤵
                                                            PID:1652
                                                            • C:\Windows\SysWOW64\choice.exe
                                                              choice /C Y /N /D Y /T 3
                                                              12⤵
                                                                PID:2096
                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                              11⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious behavior: MapViewOfSection
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2104
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                12⤵
                                                                • Suspicious behavior: SetClipboardViewer
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2216
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                12⤵
                                                                  PID:2236
                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                    choice /C Y /N /D Y /T 3
                                                                    13⤵
                                                                      PID:2280
                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                    12⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2308
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      13⤵
                                                                      • Accesses Microsoft Outlook profiles
                                                                      • Suspicious behavior: SetClipboardViewer
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2444
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                      13⤵
                                                                        PID:2464
                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                          choice /C Y /N /D Y /T 3
                                                                          14⤵
                                                                            PID:2504
                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                          13⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2532
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            14⤵
                                                                            • Accesses Microsoft Outlook profiles
                                                                            • Suspicious behavior: SetClipboardViewer
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2620
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                            14⤵
                                                                              PID:2640
                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                choice /C Y /N /D Y /T 3
                                                                                15⤵
                                                                                  PID:2704
                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                14⤵
                                                                                • Suspicious use of SetThreadContext
                                                                                • Suspicious behavior: MapViewOfSection
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2716
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  15⤵
                                                                                  • Accesses Microsoft Outlook profiles
                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2816
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                  15⤵
                                                                                    PID:2836
                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                      choice /C Y /N /D Y /T 3
                                                                                      16⤵
                                                                                        PID:2880
                                                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                      15⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2908
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        16⤵
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2984
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                        16⤵
                                                                                          PID:3012
                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                            choice /C Y /N /D Y /T 3
                                                                                            17⤵
                                                                                              PID:3068
                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                            16⤵
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1648
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              17⤵
                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1520
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                              17⤵
                                                                                                PID:880
                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                  18⤵
                                                                                                    PID:1544
                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                  17⤵
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2052
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    18⤵
                                                                                                      PID:2268
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                      18⤵
                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2700
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                      18⤵
                                                                                                        PID:2740
                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                          19⤵
                                                                                                            PID:2460
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                          18⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2692
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                            19⤵
                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2684
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                            19⤵
                                                                                                              PID:2548
                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                20⤵
                                                                                                                  PID:2884
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                19⤵
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2852
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                  20⤵
                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2280
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                  20⤵
                                                                                                                    PID:3052
                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                      21⤵
                                                                                                                        PID:1832
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                      20⤵
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2468
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                        21⤵
                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2876
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                        21⤵
                                                                                                                          PID:2440
                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                            22⤵
                                                                                                                              PID:2288
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                            21⤵
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2856
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              22⤵
                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2904
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                              22⤵
                                                                                                                                PID:2096
                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                  23⤵
                                                                                                                                    PID:560
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                  22⤵
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2496
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    23⤵
                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3104
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                    23⤵
                                                                                                                                      PID:3132
                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                        24⤵
                                                                                                                                          PID:3172
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                        23⤵
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3192
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          24⤵
                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:3280
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                          24⤵
                                                                                                                                            PID:3308
                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                              25⤵
                                                                                                                                                PID:3348
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                              24⤵
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:3372
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                25⤵
                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:3456
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                25⤵
                                                                                                                                                  PID:3476
                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                    26⤵
                                                                                                                                                      PID:3524
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                    25⤵
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:3548
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      26⤵
                                                                                                                                                        PID:3632
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        26⤵
                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3640
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                        26⤵
                                                                                                                                                          PID:3660
                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                            27⤵
                                                                                                                                                              PID:3720
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                            26⤵
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3740
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                              27⤵
                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:3828
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                              27⤵
                                                                                                                                                                PID:3848
                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                  28⤵
                                                                                                                                                                    PID:3880
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                  27⤵
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:3896
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                    28⤵
                                                                                                                                                                      PID:3984
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                      28⤵
                                                                                                                                                                        PID:4004
                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                          29⤵
                                                                                                                                                                            PID:4044
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                          28⤵
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:4060
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                            29⤵
                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2968
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                            29⤵
                                                                                                                                                                              PID:3216
                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                30⤵
                                                                                                                                                                                  PID:3236
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                29⤵
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:1512
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                  30⤵
                                                                                                                                                                                    PID:1776
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    30⤵
                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:3124
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                    30⤵
                                                                                                                                                                                      PID:3132
                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                        31⤵
                                                                                                                                                                                          PID:3340
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                        30⤵
                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:3208
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          31⤵
                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                          PID:3860
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                          31⤵
                                                                                                                                                                                            PID:3732
                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                              32⤵
                                                                                                                                                                                                PID:3708
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                              31⤵
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:3720
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                32⤵
                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                PID:1568
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                32⤵
                                                                                                                                                                                                  PID:1208
                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                      PID:3672
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                        PID:580
                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                              PID:3772
                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                  PID:3912
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:2576
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                    PID:3632
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                        PID:2880
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                      35⤵
                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:3672
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                        PID:2628
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                              PID:3356
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                PID:4044
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                PID:4016
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                  PID:3772
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                      PID:3840
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                    PID:2632
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                      PID:3700
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                      PID:4528
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                              PID:4696
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                            41⤵
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              42⤵
                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                              42⤵
                                                                                                                                                                                                                                                                PID:4916
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                  42⤵
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                          PID:3120
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                        43⤵
                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                        PID:3660
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                          PID:2652
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                              44⤵
                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                              PID:4440
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                PID:4520
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                    45⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                      PID:3424
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                        PID:4384
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                            PID:4696
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                          PID:3484
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                            PID:4976
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                              PID:2704
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                  PID:5016
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                      PID:1740
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                              PID:4700
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                    PID:3568
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                      PID:3884
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                        51⤵
                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                        PID:4300
                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                PID:692
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                              PID:3304
                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                  PID:4044
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                    PID:2044
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                        PID:5204
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                                                            PID:5260
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                            PID:5408
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                              PID:5440
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5584
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                    PID:5592
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                          PID:5780
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6016
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6052
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                    PID:6076
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                            • outlook_office_path
                                                                                                                                                                                                                                                                                                                                                                            • outlook_win_path
                                                                                                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5240
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                PID:4792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5776
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5448
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                        PID:5436
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:5520
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5688
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6060
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DHL INTERNATIONAL GMBH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6196

                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                • memory/112-129-0x00000000048F5000-0x0000000004906000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/112-90-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/556-120-0x00000000006A5000-0x00000000006B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/556-82-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/788-70-0x0000000000210000-0x0000000000260000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/800-93-0x0000000000330000-0x0000000000380000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/868-78-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/868-116-0x0000000004AC5000-0x0000000004AD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/976-110-0x0000000000C65000-0x0000000000C76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/976-67-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1092-57-0x0000000075831000-0x0000000075833000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1092-58-0x0000000000450000-0x00000000004C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  448KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1092-55-0x0000000000D50000-0x0000000000E1E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  824KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1092-56-0x00000000009D0000-0x0000000000A68000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  608KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1328-60-0x0000000000400000-0x0000000000490000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  576KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1328-61-0x0000000000390000-0x0000000000396000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1328-63-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1352-97-0x0000000000840000-0x0000000000841000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1352-139-0x0000000000845000-0x0000000000856000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1356-74-0x0000000002660000-0x0000000004780000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  33.1MB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1356-112-0x0000000002660000-0x0000000004780000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  33.1MB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1360-76-0x00000000001D0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1504-84-0x0000000000440000-0x0000000000491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  324KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1520-124-0x00000000028D0000-0x00000000028D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1520-165-0x00000000028D5000-0x00000000028E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1648-123-0x00000000002B0000-0x0000000000300000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1656-89-0x00000000001D0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  964KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1712-81-0x0000000000390000-0x00000000003C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1736-65-0x0000000000330000-0x0000000000333000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1824-94-0x00000000003A0000-0x00000000003E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1824-134-0x00000000003A0000-0x00000000003E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1840-126-0x0000000004AC5000-0x0000000004AD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1840-85-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1848-113-0x0000000004CD5000-0x0000000004CE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/1848-71-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2104-99-0x00000000001C0000-0x0000000000211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  324KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2216-101-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2280-172-0x0000000000855000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2280-138-0x0000000000850000-0x0000000000851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2308-104-0x00000000002C0000-0x0000000000351000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  580KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2444-105-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2444-147-0x0000000004CB5000-0x0000000004CC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2620-108-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2620-151-0x0000000004A75000-0x0000000004A86000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2684-133-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2692-130-0x0000000000430000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2700-127-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2700-167-0x0000000004B15000-0x0000000004B26000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2816-157-0x0000000004D35000-0x0000000004D46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2816-114-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2852-137-0x0000000000390000-0x00000000003C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2856-144-0x00000000002B0000-0x0000000000300000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2876-142-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2904-146-0x0000000000930000-0x0000000000931000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2908-117-0x0000000000310000-0x00000000003F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  896KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2968-174-0x0000000002260000-0x00000000024C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  2.4MB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/2984-119-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3104-150-0x0000000004850000-0x0000000004851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3124-177-0x0000000002590000-0x00000000046E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  33.3MB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3192-154-0x0000000000210000-0x0000000000240000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3280-155-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3456-159-0x0000000000490000-0x00000000005E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3640-162-0x0000000004900000-0x0000000004901000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/3828-169-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                • memory/4060-171-0x00000000003D0000-0x0000000000400000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                                                                                                  Download