Overview

overview

10

Static

static

BALANCE PA...18.exe

windows7_x64

10

BALANCE PA...18.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-02-2022 11:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BALANCE PAYMENT OF INV #005788903736282 20200418.exe

  • Size

    798KB

  • MD5

    c7848797c3eb098eb5e6430baf4a26e1

  • SHA1

    0c954e2e62839957e9746dae3438eb4aed1fe5b8

  • SHA256

    088065e6c2fc3b413563bc44b0626a13ad9e32a330ae958dd24141862c3c90de

  • SHA512

    7bc7071d52dd3ec1cfc9f5b4642110c8605f6eddbc22a669cc69ba33be86cf3ea991db231617f5fb3e23fd3cc3020cc01a1bb9becef49bc79dc028df7f9371de

Score
10/10
hawkeye_rebornm00nd3v_loggercollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

  • Protocol:     smtp
  • Host:
    mail.bigmanstan.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    khalifa@2020
Mutex

c4ceaee6-98e6-414f-92f0-272fe7bd057c

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:khalifa@2020 _EmailPort:587 _EmailSSL:false _EmailServer:mail.bigmanstan.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:c4ceaee6-98e6-414f-92f0-272fe7bd057c _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger Payload 2 IoCs

    Detects M00nD3v Logger payload in memory.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: SetClipboardViewer 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      PID:884
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 3
        3⤵
          PID:760
      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: SetClipboardViewer
          • Suspicious use of AdjustPrivilegeToken
          PID:1352
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:584
          • C:\Windows\SysWOW64\choice.exe
            choice /C Y /N /D Y /T 3
            4⤵
              PID:1500
          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:536
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Suspicious behavior: SetClipboardViewer
              • Suspicious use of AdjustPrivilegeToken
              PID:1236
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:364
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:1932
              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                4⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1052
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • Suspicious behavior: SetClipboardViewer
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1524
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                  5⤵
                    PID:1540
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      6⤵
                        PID:1840
                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                      5⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1728
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • Accesses Microsoft Outlook profiles
                        • Suspicious behavior: SetClipboardViewer
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1296
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                        6⤵
                          PID:1568
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 3
                            7⤵
                              PID:1088
                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                            6⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            PID:524
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              7⤵
                              • Accesses Microsoft Outlook profiles
                              • Suspicious behavior: SetClipboardViewer
                              • Suspicious use of AdjustPrivilegeToken
                              PID:268
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                              7⤵
                                PID:1640
                                • C:\Windows\SysWOW64\choice.exe
                                  choice /C Y /N /D Y /T 3
                                  8⤵
                                    PID:1624
                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                  7⤵
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1584
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    8⤵
                                    • Suspicious behavior: SetClipboardViewer
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:644
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                    8⤵
                                      PID:1820
                                      • C:\Windows\SysWOW64\choice.exe
                                        choice /C Y /N /D Y /T 3
                                        9⤵
                                          PID:1604
                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                        8⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1560
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          9⤵
                                          • Suspicious behavior: SetClipboardViewer
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1544
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                          9⤵
                                            PID:304
                                            • C:\Windows\SysWOW64\choice.exe
                                              choice /C Y /N /D Y /T 3
                                              10⤵
                                                PID:1920
                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                              9⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:924
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                10⤵
                                                • Suspicious behavior: SetClipboardViewer
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1816
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                10⤵
                                                  PID:1644
                                                  • C:\Windows\SysWOW64\choice.exe
                                                    choice /C Y /N /D Y /T 3
                                                    11⤵
                                                      PID:2076
                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                    10⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious behavior: MapViewOfSection
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2108
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      11⤵
                                                      • Suspicious behavior: SetClipboardViewer
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2188
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                      11⤵
                                                        PID:2208
                                                        • C:\Windows\SysWOW64\choice.exe
                                                          choice /C Y /N /D Y /T 3
                                                          12⤵
                                                            PID:2280
                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                          11⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2288
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            12⤵
                                                            • Suspicious behavior: SetClipboardViewer
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2356
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                            12⤵
                                                              PID:2376
                                                              • C:\Windows\SysWOW64\choice.exe
                                                                choice /C Y /N /D Y /T 3
                                                                13⤵
                                                                  PID:2424
                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                12⤵
                                                                • Suspicious use of SetThreadContext
                                                                • Suspicious behavior: MapViewOfSection
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2456
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  13⤵
                                                                    PID:2556
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    13⤵
                                                                    • Suspicious behavior: SetClipboardViewer
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2564
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                    13⤵
                                                                      PID:2600
                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                        choice /C Y /N /D Y /T 3
                                                                        14⤵
                                                                          PID:2636
                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                        13⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2656
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          14⤵
                                                                          • Accesses Microsoft Outlook profiles
                                                                          • Suspicious behavior: SetClipboardViewer
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2740
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                          14⤵
                                                                            PID:2772
                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                              choice /C Y /N /D Y /T 3
                                                                              15⤵
                                                                                PID:2808
                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                              14⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2828
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                15⤵
                                                                                  PID:2920
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  15⤵
                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2928
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                  15⤵
                                                                                    PID:2948
                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                      choice /C Y /N /D Y /T 3
                                                                                      16⤵
                                                                                        PID:3004
                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                      15⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3028
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        16⤵
                                                                                        • Accesses Microsoft Outlook profiles
                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1604
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                        16⤵
                                                                                          PID:2184
                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                            choice /C Y /N /D Y /T 3
                                                                                            17⤵
                                                                                              PID:1660
                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                            16⤵
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2260
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              17⤵
                                                                                              • Accesses Microsoft Outlook profiles
                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2056
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                              17⤵
                                                                                                PID:2464
                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                  18⤵
                                                                                                    PID:2612
                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                  17⤵
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2420
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    18⤵
                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2572
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                    18⤵
                                                                                                      PID:2848
                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                        19⤵
                                                                                                          PID:2900
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                        18⤵
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2748
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          19⤵
                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:584
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                          19⤵
                                                                                                            PID:1712
                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                              20⤵
                                                                                                                PID:1820
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                              19⤵
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2776
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                20⤵
                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2228
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                20⤵
                                                                                                                  PID:2704
                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                    21⤵
                                                                                                                      PID:2376
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                    20⤵
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2148
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      21⤵
                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2304
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                      21⤵
                                                                                                                        PID:2132
                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                          22⤵
                                                                                                                            PID:2080
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                          21⤵
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3004
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                            22⤵
                                                                                                                              PID:2600
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              22⤵
                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1104
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                              22⤵
                                                                                                                                PID:2476
                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                  23⤵
                                                                                                                                    PID:2924
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                  22⤵
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2940
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    23⤵
                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2280
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                    23⤵
                                                                                                                                      PID:3076
                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                        24⤵
                                                                                                                                          PID:3132
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                        23⤵
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3160
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          24⤵
                                                                                                                                            PID:3256
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                            24⤵
                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:3264
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                            24⤵
                                                                                                                                              PID:3288
                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                25⤵
                                                                                                                                                  PID:3344
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                24⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:3360
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                  25⤵
                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3444
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                  25⤵
                                                                                                                                                    PID:3464
                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                      26⤵
                                                                                                                                                        PID:3508
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                      25⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:3532
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        26⤵
                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:3620
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                        26⤵
                                                                                                                                                          PID:3640
                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                            27⤵
                                                                                                                                                              PID:3696
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                            26⤵
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3720
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                              27⤵
                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:3804
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                              27⤵
                                                                                                                                                                PID:3844
                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                  28⤵
                                                                                                                                                                    PID:3912
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                  27⤵
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:3892
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                    28⤵
                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:3992
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                    28⤵
                                                                                                                                                                      PID:4012
                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                        29⤵
                                                                                                                                                                          PID:2716
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                        28⤵
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4056
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                          29⤵
                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:3228
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                          29⤵
                                                                                                                                                                            PID:3320
                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                              30⤵
                                                                                                                                                                                PID:2468
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                              29⤵
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:3152
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                30⤵
                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                PID:3100
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                30⤵
                                                                                                                                                                                  PID:3136
                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                    31⤵
                                                                                                                                                                                      PID:2300
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                    30⤵
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:3652
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                      31⤵
                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                      PID:2436
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                      31⤵
                                                                                                                                                                                        PID:3364
                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                          32⤵
                                                                                                                                                                                            PID:3512
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                          31⤵
                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:3468
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                            32⤵
                                                                                                                                                                                              PID:3696
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                              32⤵
                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                              PID:3644
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                              32⤵
                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:2996
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                    PID:4008
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                          PID:4068
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                        33⤵
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                              34⤵
                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                35⤵
                                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                      PID:4004
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                      36⤵
                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                          37⤵
                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:4020
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                            PID:3000
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                              PID:1464
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                37⤵
                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                PID:4172
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                  PID:4252
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                  38⤵
                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                        PID:4320
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                      38⤵
                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                        39⤵
                                                                                                                                                                                                                                          PID:4456
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                            40⤵
                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                            39⤵
                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                  40⤵
                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                    41⤵
                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                        PID:4908
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                            PID:5000
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                43⤵
                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                42⤵
                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                  PID:2704
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                    PID:1892
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                        PID:1944
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                      43⤵
                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                              PID:2640
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                PID:4868
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                  45⤵
                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                    46⤵
                                                                                                                                                                                                                                                                                      PID:4636
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                        PID:4672
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                          PID:4832
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                47⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                    PID:3948
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                    PID:1944
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                          PID:4132
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                        48⤵
                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                        PID:3280
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                          PID:764
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                            PID:4868
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                PID:4012
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                      PID:3956
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                                                                                        PID:3036
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                          PID:4504
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                  PID:3956
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                      PID:5292
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                        PID:5408
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                                                                                                                                          PID:5428
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                              PID:5588
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                PID:5624
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                    PID:5712
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                          PID:5892
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5952
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                PID:6080
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6112
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                    PID:4132
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                      PID:2944
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3256
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                          PID:3452
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                            PID:5672
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5704
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                PID:5452
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6092
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                      PID:3580
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                            PID:2708
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                              66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6196
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6324
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6504
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6532
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6568
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6684
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6692
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6700
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            81⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              85⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • outlook_office_path
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • outlook_win_path
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:900

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/268-118-0x0000000004AD5000-0x0000000004AE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/268-81-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/524-79-0x00000000001C0000-0x0000000000210000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/536-68-0x0000000000370000-0x0000000000373000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/584-169-0x0000000004C95000-0x0000000004CA6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/584-128-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/644-85-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/884-58-0x00000000003B0000-0x00000000003B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/884-60-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/884-57-0x0000000000400000-0x0000000000490000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  576KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/924-92-0x00000000001D0000-0x00000000002A0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  832KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1052-71-0x00000000002B0000-0x0000000000300000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1104-141-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1236-104-0x00000000004C5000-0x00000000004D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1236-69-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1296-77-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1296-113-0x0000000004E25000-0x0000000004E36000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1352-65-0x0000000000490000-0x00000000004E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1352-100-0x0000000000490000-0x00000000004E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1440-53-0x0000000001330000-0x00000000013FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  824KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1440-54-0x0000000000AF0000-0x0000000000B88000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  608KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1440-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1440-59-0x0000000000220000-0x0000000000260000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1524-72-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1524-109-0x0000000004C35000-0x0000000004C46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1544-89-0x0000000004A40000-0x0000000004A41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1544-125-0x0000000004A45000-0x0000000004A56000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1560-87-0x0000000000240000-0x0000000000293000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  332KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1584-84-0x00000000001B0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1604-117-0x0000000001230000-0x0000000001231000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1604-156-0x0000000001235000-0x0000000001246000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1728-76-0x0000000000390000-0x00000000003E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  344KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1816-93-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1816-129-0x0000000004ED5000-0x0000000004EE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1888-64-0x00000000002B0000-0x0000000000300000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2056-160-0x0000000004E55000-0x0000000004E66000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2056-121-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2188-96-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2188-134-0x0000000004A75000-0x0000000004A86000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2228-132-0x0000000001170000-0x0000000001171000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2280-145-0x00000000027E0000-0x00000000027E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2304-135-0x00000000009D0000-0x00000000009D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2356-137-0x0000000004BA5000-0x0000000004BB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2356-99-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2564-142-0x0000000000490000-0x0000000000600000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2564-103-0x0000000000490000-0x0000000000600000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2572-123-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2572-164-0x0000000000665000-0x0000000000676000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2656-107-0x00000000001C0000-0x0000000000210000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2740-147-0x0000000001045000-0x0000000001056000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2740-108-0x0000000001040000-0x0000000001041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2928-152-0x0000000004CD5000-0x0000000004CE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2928-111-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2940-144-0x00000000004C0000-0x00000000005A3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  908KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3004-140-0x0000000000330000-0x0000000000380000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3028-114-0x0000000000350000-0x00000000003C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  460KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3160-148-0x0000000000230000-0x00000000002C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  576KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3228-173-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3264-151-0x0000000001230000-0x0000000001231000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3444-155-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3620-159-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3804-163-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3892-167-0x00000000001E0000-0x0000000000210000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3992-168-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4056-172-0x00000000001B0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download