Overview

overview

10

Static

static

BALANCE PA...18.exe

windows7_x64

10

BALANCE PA...18.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    162s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    05-02-2022 11:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BALANCE PAYMENT OF INV #005788903736282 20200418.exe

  • Size

    798KB

  • MD5

    c7848797c3eb098eb5e6430baf4a26e1

  • SHA1

    0c954e2e62839957e9746dae3438eb4aed1fe5b8

  • SHA256

    088065e6c2fc3b413563bc44b0626a13ad9e32a330ae958dd24141862c3c90de

  • SHA512

    7bc7071d52dd3ec1cfc9f5b4642110c8605f6eddbc22a669cc69ba33be86cf3ea991db231617f5fb3e23fd3cc3020cc01a1bb9becef49bc79dc028df7f9371de

Score
10/10
hawkeye_rebornm00nd3v_loggercollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

  • Protocol:     smtp
  • Host:
    mail.bigmanstan.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    khalifa@2020
Mutex

c4ceaee6-98e6-414f-92f0-272fe7bd057c

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:khalifa@2020 _EmailPort:587 _EmailSSL:false _EmailServer:mail.bigmanstan.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:c4ceaee6-98e6-414f-92f0-272fe7bd057c _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger Payload 1 IoCs

    Detects M00nD3v Logger payload in memory.

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Looks up external IP address via web service 18 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: SetClipboardViewer 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      PID:1460
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 3
        3⤵
          PID:1492
      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:1656
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of AdjustPrivilegeToken
            PID:3036
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3240
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              4⤵
                PID:1464
            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
              3⤵
              • Checks computer location settings
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3228
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • Accesses Microsoft Outlook profiles
                • Suspicious behavior: SetClipboardViewer
                • Suspicious use of AdjustPrivilegeToken
                PID:384
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2844
                • C:\Windows\SysWOW64\choice.exe
                  choice /C Y /N /D Y /T 3
                  5⤵
                    PID:3696
                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                  4⤵
                  • Checks computer location settings
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1124
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                    • Accesses Microsoft Outlook profiles
                    • Suspicious behavior: SetClipboardViewer
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3340
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2968
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      6⤵
                        PID:2464
                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                      5⤵
                      • Checks computer location settings
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2520
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • Accesses Microsoft Outlook profiles
                        • Suspicious behavior: SetClipboardViewer
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1020
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:840
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 3
                          7⤵
                            PID:3324
                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                          6⤵
                          • Checks computer location settings
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1920
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            7⤵
                            • Suspicious behavior: SetClipboardViewer
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3268
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                            7⤵
                              PID:672
                              • C:\Windows\SysWOW64\choice.exe
                                choice /C Y /N /D Y /T 3
                                8⤵
                                  PID:1528
                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                7⤵
                                • Checks computer location settings
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2640
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  8⤵
                                  • Accesses Microsoft Outlook profiles
                                  • Suspicious behavior: SetClipboardViewer
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3620
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                  8⤵
                                    PID:3416
                                    • C:\Windows\SysWOW64\choice.exe
                                      choice /C Y /N /D Y /T 3
                                      9⤵
                                        PID:752
                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                      8⤵
                                      • Checks computer location settings
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:376
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        9⤵
                                          PID:64
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          9⤵
                                          • Accesses Microsoft Outlook profiles
                                          • Suspicious behavior: SetClipboardViewer
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2188
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                          9⤵
                                            PID:3312
                                            • C:\Windows\SysWOW64\choice.exe
                                              choice /C Y /N /D Y /T 3
                                              10⤵
                                                PID:3908
                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                              9⤵
                                              • Checks computer location settings
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2844
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                10⤵
                                                  PID:1492
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  10⤵
                                                  • Accesses Microsoft Outlook profiles
                                                  • Suspicious behavior: SetClipboardViewer
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4092
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                  10⤵
                                                    PID:3812
                                                    • C:\Windows\SysWOW64\choice.exe
                                                      choice /C Y /N /D Y /T 3
                                                      11⤵
                                                        PID:216
                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                      10⤵
                                                      • Checks computer location settings
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious behavior: MapViewOfSection
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3772
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        11⤵
                                                        • Accesses Microsoft Outlook profiles
                                                        • Suspicious behavior: SetClipboardViewer
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1900
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                        11⤵
                                                          PID:808
                                                          • C:\Windows\SysWOW64\choice.exe
                                                            choice /C Y /N /D Y /T 3
                                                            12⤵
                                                              PID:3440
                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                            11⤵
                                                            • Checks computer location settings
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious behavior: MapViewOfSection
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1512
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              12⤵
                                                              • Accesses Microsoft Outlook profiles
                                                              • Suspicious behavior: SetClipboardViewer
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3740
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                              12⤵
                                                                PID:1516
                                                                • C:\Windows\SysWOW64\choice.exe
                                                                  choice /C Y /N /D Y /T 3
                                                                  13⤵
                                                                    PID:752
                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                  12⤵
                                                                  • Checks computer location settings
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4048
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    13⤵
                                                                      PID:1212
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      13⤵
                                                                        PID:456
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        13⤵
                                                                          PID:392
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          13⤵
                                                                          • Accesses Microsoft Outlook profiles
                                                                          • Suspicious behavior: SetClipboardViewer
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:376
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                          13⤵
                                                                            PID:4056
                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                              choice /C Y /N /D Y /T 3
                                                                              14⤵
                                                                                PID:3176
                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                              13⤵
                                                                              • Checks computer location settings
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:180
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                14⤵
                                                                                  PID:2968
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  14⤵
                                                                                  • Accesses Microsoft Outlook profiles
                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2980
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                  14⤵
                                                                                    PID:764
                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                      choice /C Y /N /D Y /T 3
                                                                                      15⤵
                                                                                        PID:2112
                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                      14⤵
                                                                                      • Checks computer location settings
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2328
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        15⤵
                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1920
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                        15⤵
                                                                                          PID:1880
                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                            choice /C Y /N /D Y /T 3
                                                                                            16⤵
                                                                                              PID:2640
                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                            15⤵
                                                                                            • Checks computer location settings
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3416
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              16⤵
                                                                                              • Accesses Microsoft Outlook profiles
                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:216
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                              16⤵
                                                                                                PID:4108
                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                  17⤵
                                                                                                    PID:4168
                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                  16⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4184
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    17⤵
                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4260
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                    17⤵
                                                                                                      PID:4316
                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                        18⤵
                                                                                                          PID:4380
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                        17⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4388
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          18⤵
                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4464
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                          18⤵
                                                                                                            PID:4528
                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                              19⤵
                                                                                                                PID:4572
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                              18⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4600
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                19⤵
                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4676
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                19⤵
                                                                                                                  PID:4736
                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                    20⤵
                                                                                                                      PID:4784
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                    19⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4808
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      20⤵
                                                                                                                        PID:4884
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                        20⤵
                                                                                                                          PID:4892
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                          20⤵
                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4900
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                          20⤵
                                                                                                                            PID:4964
                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                              21⤵
                                                                                                                                PID:5012
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                              20⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5036
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                21⤵
                                                                                                                                  PID:5116
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  21⤵
                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2000
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                  21⤵
                                                                                                                                    PID:3160
                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                      22⤵
                                                                                                                                        PID:4232
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                      21⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:3924
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        22⤵
                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3468
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                        22⤵
                                                                                                                                          PID:204
                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                            23⤵
                                                                                                                                              PID:4004
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                            22⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:964
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              23⤵
                                                                                                                                                PID:4628
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                23⤵
                                                                                                                                                  PID:4648
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                  23⤵
                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3624
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                  23⤵
                                                                                                                                                    PID:4184
                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                      24⤵
                                                                                                                                                        PID:4356
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                      23⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:3476
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        24⤵
                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:4504
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                        24⤵
                                                                                                                                                          PID:4536
                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                            25⤵
                                                                                                                                                              PID:4784
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                            24⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:4616
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                              25⤵
                                                                                                                                                                PID:4756
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                25⤵
                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4772
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                25⤵
                                                                                                                                                                  PID:4932
                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                    26⤵
                                                                                                                                                                      PID:4808
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                    25⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:4964
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      26⤵
                                                                                                                                                                        PID:4240
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                        26⤵
                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:5040
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                        26⤵
                                                                                                                                                                          PID:2600
                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                            27⤵
                                                                                                                                                                              PID:3156
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                            26⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2924
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                              27⤵
                                                                                                                                                                                PID:4364
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                27⤵
                                                                                                                                                                                  PID:3592
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                  27⤵
                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:4180
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                  27⤵
                                                                                                                                                                                    PID:5116
                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                      28⤵
                                                                                                                                                                                        PID:440
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                      27⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:4348
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                        28⤵
                                                                                                                                                                                          PID:3392
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          28⤵
                                                                                                                                                                                            PID:4888
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                            28⤵
                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:4896
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                            28⤵
                                                                                                                                                                                              PID:4860
                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                29⤵
                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                28⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:632
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                  29⤵
                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                      29⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:5052
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                        30⤵
                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:4328
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                          30⤵
                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                  PID:4800
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                      PID:5140
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:5168
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                      32⤵
                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:5388
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                              PID:5444
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                              PID:5452
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                              33⤵
                                                                                                                                                                                                                                PID:5508
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                    PID:5580
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:5612
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                                                      PID:5712
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                                          PID:5764
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                          PID:5864
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                              36⤵
                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                PID:6076
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                36⤵
                                                                                                                                                                                                                                                  PID:6132
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                    37⤵
                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                      PID:5152
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                      37⤵
                                                                                                                                                                                                                                                        PID:4112
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                          38⤵
                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                          37⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                            PID:2740
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                PID:5292
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                    PID:5404
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                      40⤵
                                                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                        40⤵
                                                                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                                                            PID:2500
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                              41⤵
                                                                                                                                                                                                                                                                                PID:5896
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                              40⤵
                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                              PID:5808
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                PID:4540
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                                                  PID:5180
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                                                        PID:5360
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                      PID:5160
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                          42⤵
                                                                                                                                                                                                                                                                                            PID:2880
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                                                                                                PID:5184
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                              42⤵
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                              PID:5356
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                43⤵
                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                PID:4808
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                43⤵
                                                                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                    43⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                    PID:5916
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                                                              PID:3100
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                  PID:5140
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                PID:4176
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                                                    PID:3500
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                                                        PID:5956
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                      PID:5356
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                        PID:5604
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                                                          PID:3632
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                                                              PID:5912
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                            PID:5760
                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                  PID:5748
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                                                      PID:3196
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                                                                        PID:556
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                          PID:4088
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                                                                                                              PID:4044
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6156
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                50⤵
                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                PID:6180
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                  PID:6252
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6308
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6360
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                      PID:6388
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                        PID:6456
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6512
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6564
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                            PID:6588
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                              PID:6660
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6724
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6780
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                  PID:6796
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                    PID:6876
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                    54⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6868
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6940
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6984
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                          PID:7012
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:7080
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                              PID:7088
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7152
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1736
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                  PID:3752
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6428
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                        PID:6164
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                          PID:2908
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6632
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6352
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                              PID:6188
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6584
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6564
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6508
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7000
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                            • outlook_office_path
                                                                                                                                                                                                                                                                                                                                                                                                            • outlook_win_path
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6732
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6796
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        60⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7128
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6436
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6560
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6464
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6500
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6704
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6696
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\BALANCE PAYMENT OF INV #005788903736282 20200418.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6172
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\MusNotifyIcon.exe
                                                                                                                                                                                                                                                                                                                                        %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                        PID:2804
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                        PID:1532

                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                      • memory/216-159-0x0000000005470000-0x00000000054F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        512KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/376-148-0x0000000002910000-0x0000000002950000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        256KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/376-155-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/384-138-0x0000000005730000-0x0000000005731000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/632-177-0x0000000000EF0000-0x0000000000F20000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1020-144-0x00000000051C0000-0x00000000051C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1124-139-0x0000000004C10000-0x0000000004C40000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1460-134-0x000000000ADB0000-0x000000000AE4C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        624KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1460-137-0x000000000AE50000-0x000000000AEB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1460-141-0x000000000BA60000-0x000000000C004000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1460-142-0x000000000B4B0000-0x000000000B542000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1460-133-0x0000000005820000-0x0000000005821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1460-132-0x0000000000400000-0x0000000000490000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        576KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1512-153-0x0000000001780000-0x0000000001841000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        772KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1900-151-0x0000000005460000-0x0000000005461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/1920-157-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2000-167-0x0000000002E40000-0x0000000002E41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2188-149-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2520-143-0x0000000001320000-0x0000000001350000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2640-146-0x0000000000F10000-0x0000000000FC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        704KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2740-191-0x00000000055B0000-0x00000000055B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2884-131-0x00000000059A0000-0x00000000059A3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2884-130-0x0000000000F90000-0x000000000105E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        824KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2904-135-0x0000000002CB0000-0x0000000002D91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        900KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/2980-156-0x0000000005340000-0x0000000005341000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3036-136-0x00000000058E0000-0x00000000058E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3036-152-0x0000000006400000-0x000000000640A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3268-145-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3340-140-0x0000000002A80000-0x0000000002AE0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        384KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3416-158-0x00000000023B0000-0x00000000023F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        256KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3468-169-0x00000000052C0000-0x00000000052C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3620-147-0x0000000005670000-0x00000000056B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        256KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3624-170-0x0000000005720000-0x00000000057C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        640KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3740-154-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/3924-168-0x00000000028B0000-0x0000000002960000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        704KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4092-150-0x0000000005350000-0x0000000005351000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4180-175-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4260-160-0x0000000005660000-0x0000000005661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4328-180-0x0000000005380000-0x0000000005381000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4388-161-0x0000000002210000-0x0000000002241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        196KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4464-162-0x00000000054E0000-0x00000000054E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4504-171-0x0000000005160000-0x0000000005161000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4532-181-0x00000000057C0000-0x00000000057C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4616-172-0x0000000003110000-0x0000000003140000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4676-163-0x0000000000E10000-0x0000000000E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4772-173-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4808-164-0x00000000029B0000-0x00000000029F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        256KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4896-176-0x0000000005540000-0x0000000005541000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/4900-165-0x0000000002920000-0x0000000002A00000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        896KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5024-178-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5036-166-0x0000000005230000-0x0000000005260000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5040-174-0x0000000005700000-0x0000000005701000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5052-179-0x0000000002D10000-0x0000000002DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        708KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5152-190-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5236-182-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5452-183-0x0000000005140000-0x0000000005170000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5612-184-0x00000000026A0000-0x00000000026D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        196KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5656-185-0x0000000005220000-0x0000000005221000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5808-186-0x0000000002C70000-0x0000000002D20000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        704KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5836-192-0x00000000052A0000-0x0000000005370000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        832KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/5864-187-0x00000000052D0000-0x00000000052D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/6028-188-0x00000000027C0000-0x00000000027F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/6072-193-0x0000000002380000-0x00000000023B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        196KB

                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                      • memory/6076-189-0x00000000052D0000-0x0000000005390000-memory.dmp

                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                        768KB

                                                                                                                                                                                                                                                                                                                                        Download