Overview

overview

10

Static

static

PI_160420P...df.exe

windows7_x64

10

PI_160420P...df.exe

windows10-2004_x64

6

Analysis

  • max time kernel
    151s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    05-02-2022 16:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PI_160420PDF ARJ005634420200429 ,pdf.exe

  • Size

    781KB

  • MD5

    e132a0c2ded7c6dd950cc745862896b1

  • SHA1

    c63c29aefc1245fb66f67d0049cc682c76d6287b

  • SHA256

    2cc9a439b0ba13097ff33a8bb0af64130fec5c4f128c5cc4fcec7403e55ff50c

  • SHA512

    7ffe8b5e25f6b7b24cb5453de02b098273747d08fc4a9195791cef9876af43baf2daacb1e4785d7e416f50874b0340856b5cad7e8eded5db461cc68d0055d584

Score
10/10
hawkeye_rebornm00nd3v_loggercollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.2.2

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tashipta.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    @Success$2020
Mutex

74d527f5-bde5-4c9c-9f90-0d96801270c7

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:2 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPassword:@Success$2020 _FTPPort:21 _FTPSFTP:true _FTPServer:ftp.tashipta.com _FTPUsername:[email protected] _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:false _LogInterval:10 _MeltFile:false _Mutex:74d527f5-bde5-4c9c-9f90-0d96801270c7 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.2.2 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - RebornX, Version=10.1.2.2, Culture=neutral, PublicKeyToken=null

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nD3v Logger Payload 2 IoCs

    Detects M00nD3v Logger payload in memory.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs
    collection
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious behavior: SetClipboardViewer 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: SetClipboardViewer
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\choice.exe
        choice /C Y /N /D Y /T 3
        3⤵
          PID:1616
      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: SetClipboardViewer
          • Suspicious use of AdjustPrivilegeToken
          PID:672
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1224
          • C:\Windows\SysWOW64\choice.exe
            choice /C Y /N /D Y /T 3
            4⤵
              PID:1460
          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious behavior: SetClipboardViewer
              • Suspicious use of AdjustPrivilegeToken
              PID:1536
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:804
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:1212
              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                4⤵
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1052
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • Accesses Microsoft Outlook profiles
                  • Suspicious behavior: SetClipboardViewer
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1500
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                  5⤵
                    PID:1480
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      6⤵
                        PID:1740
                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                      5⤵
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1980
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • Accesses Microsoft Outlook profiles
                        • Suspicious behavior: SetClipboardViewer
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1476
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                        6⤵
                          PID:1720
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 3
                            7⤵
                              PID:1648
                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                            6⤵
                            • Adds Run key to start application
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1616
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              7⤵
                              • Accesses Microsoft Outlook profiles
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1956
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                              7⤵
                                PID:1556
                                • C:\Windows\SysWOW64\choice.exe
                                  choice /C Y /N /D Y /T 3
                                  8⤵
                                    PID:364
                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                  7⤵
                                  • Adds Run key to start application
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1068
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    8⤵
                                    • Accesses Microsoft Outlook profiles
                                    • Suspicious behavior: SetClipboardViewer
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:668
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                    8⤵
                                      PID:1540
                                      • C:\Windows\SysWOW64\choice.exe
                                        choice /C Y /N /D Y /T 3
                                        9⤵
                                          PID:1588
                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                        8⤵
                                        • Adds Run key to start application
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:584
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          9⤵
                                          • Accesses Microsoft Outlook profiles
                                          • Suspicious behavior: SetClipboardViewer
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1212
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                          9⤵
                                            PID:956
                                            • C:\Windows\SysWOW64\choice.exe
                                              choice /C Y /N /D Y /T 3
                                              10⤵
                                                PID:1752
                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                              9⤵
                                              • Adds Run key to start application
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1480
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                10⤵
                                                • Suspicious behavior: SetClipboardViewer
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:548
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                10⤵
                                                  PID:1828
                                                  • C:\Windows\SysWOW64\choice.exe
                                                    choice /C Y /N /D Y /T 3
                                                    11⤵
                                                      PID:1584
                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                    10⤵
                                                    • Adds Run key to start application
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious behavior: MapViewOfSection
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:740
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      11⤵
                                                      • Suspicious behavior: SetClipboardViewer
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:288
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                      11⤵
                                                        PID:1556
                                                        • C:\Windows\SysWOW64\choice.exe
                                                          choice /C Y /N /D Y /T 3
                                                          12⤵
                                                            PID:788
                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                          11⤵
                                                          • Adds Run key to start application
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1224
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            12⤵
                                                            • Accesses Microsoft Outlook profiles
                                                            • Suspicious behavior: SetClipboardViewer
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:944
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                            12⤵
                                                              PID:1900
                                                              • C:\Windows\SysWOW64\choice.exe
                                                                choice /C Y /N /D Y /T 3
                                                                13⤵
                                                                  PID:956
                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                12⤵
                                                                • Adds Run key to start application
                                                                • Suspicious use of SetThreadContext
                                                                • Suspicious behavior: MapViewOfSection
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1000
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  13⤵
                                                                  • Suspicious behavior: SetClipboardViewer
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2180
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                  13⤵
                                                                    PID:2216
                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                      choice /C Y /N /D Y /T 3
                                                                      14⤵
                                                                        PID:2248
                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                      13⤵
                                                                      • Adds Run key to start application
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2280
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        14⤵
                                                                        • Accesses Microsoft Outlook profiles
                                                                        • Suspicious behavior: SetClipboardViewer
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2376
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                        14⤵
                                                                          PID:2396
                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                            choice /C Y /N /D Y /T 3
                                                                            15⤵
                                                                              PID:2444
                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                            14⤵
                                                                            • Adds Run key to start application
                                                                            • Suspicious use of SetThreadContext
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2468
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              15⤵
                                                                                PID:2548
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                15⤵
                                                                                • Accesses Microsoft Outlook profiles
                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2556
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                15⤵
                                                                                  PID:2576
                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                    choice /C Y /N /D Y /T 3
                                                                                    16⤵
                                                                                      PID:2632
                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                    15⤵
                                                                                    • Adds Run key to start application
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2640
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                      16⤵
                                                                                      • Accesses Microsoft Outlook profiles
                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2708
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                      16⤵
                                                                                        PID:2736
                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                          choice /C Y /N /D Y /T 3
                                                                                          17⤵
                                                                                            PID:2772
                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                          16⤵
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2788
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                            17⤵
                                                                                            • Accesses Microsoft Outlook profiles
                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2868
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                            17⤵
                                                                                              PID:2888
                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                choice /C Y /N /D Y /T 3
                                                                                                18⤵
                                                                                                  PID:2936
                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                17⤵
                                                                                                • Adds Run key to start application
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2980
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                  18⤵
                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2228
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                  18⤵
                                                                                                    PID:1732
                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                      19⤵
                                                                                                        PID:2316
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                      18⤵
                                                                                                      • Adds Run key to start application
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1600
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        19⤵
                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2260
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                        19⤵
                                                                                                          PID:2616
                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                            20⤵
                                                                                                              PID:2224
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                            19⤵
                                                                                                            • Adds Run key to start application
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2720
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                              20⤵
                                                                                                                PID:2440
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                20⤵
                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2784
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                20⤵
                                                                                                                  PID:2840
                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                    21⤵
                                                                                                                      PID:2496
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                    20⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:648
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      21⤵
                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:2748
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                      21⤵
                                                                                                                        PID:2792
                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                          22⤵
                                                                                                                            PID:2700
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                          21⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2892
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                            22⤵
                                                                                                                              PID:2384
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              22⤵
                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2736
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                              22⤵
                                                                                                                                PID:2224
                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                  23⤵
                                                                                                                                    PID:2440
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                  22⤵
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2568
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    23⤵
                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3152
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                    23⤵
                                                                                                                                      PID:3168
                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                        24⤵
                                                                                                                                          PID:3216
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                        23⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3232
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          24⤵
                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:3324
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                          24⤵
                                                                                                                                            PID:3364
                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                              25⤵
                                                                                                                                                PID:3420
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                              24⤵
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:3428
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                25⤵
                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:3556
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                25⤵
                                                                                                                                                  PID:3576
                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                    26⤵
                                                                                                                                                      PID:3632
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                    25⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:3644
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      26⤵
                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:3760
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                      26⤵
                                                                                                                                                        PID:3796
                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                          27⤵
                                                                                                                                                            PID:3844
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                          26⤵
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:3852
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                            27⤵
                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3888
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                            27⤵
                                                                                                                                                              PID:3908
                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                28⤵
                                                                                                                                                                  PID:3968
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                27⤵
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:3980
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                  28⤵
                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:2776
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                  28⤵
                                                                                                                                                                    PID:2360
                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                      29⤵
                                                                                                                                                                        PID:3256
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                      28⤵
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1904
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                        29⤵
                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:3460
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                        29⤵
                                                                                                                                                                          PID:3612
                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                            30⤵
                                                                                                                                                                              PID:3172
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                            29⤵
                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:3728
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                              30⤵
                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                              PID:3400
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                              30⤵
                                                                                                                                                                                PID:3880
                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                  31⤵
                                                                                                                                                                                    PID:3608
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                  30⤵
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:4016
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    31⤵
                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                    PID:3672
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                    31⤵
                                                                                                                                                                                      PID:3796
                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                        32⤵
                                                                                                                                                                                          PID:3628
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                        31⤵
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:2612
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          32⤵
                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                          PID:3500
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                          32⤵
                                                                                                                                                                                            PID:1440
                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                              33⤵
                                                                                                                                                                                                PID:2000
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                              32⤵
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:2276
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                33⤵
                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                PID:1820
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                33⤵
                                                                                                                                                                                                  PID:3732
                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                    34⤵
                                                                                                                                                                                                      PID:3580
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                    33⤵
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:3640
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                      PID:4160
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                          34⤵
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                            35⤵
                                                                                                                                                                                                              PID:4384
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                              PID:4392
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                              35⤵
                                                                                                                                                                                                                PID:4428
                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                  36⤵
                                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                  35⤵
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:4480
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:4648
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                          37⤵
                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                          37⤵
                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                              38⤵
                                                                                                                                                                                                                                PID:4816
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                  PID:4940
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                    38⤵
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                      39⤵
                                                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                          40⤵
                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                          39⤵
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                          PID:3404
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                            40⤵
                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                            40⤵
                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                41⤵
                                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                40⤵
                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                                                                    PID:4548
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                      PID:904
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                            PID:4492
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                      44⤵
                                                                                                                                                                                                                                                                        PID:3276
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                          45⤵
                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                          44⤵
                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                  PID:3744
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                PID:3876
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                  PID:1556
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                            47⤵
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                                                                PID:4300
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                                                                                                    PID:4576
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                  48⤵
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                  PID:3376
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                    PID:4448
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                                                                      PID:4072
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                        PID:4804
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                          PID:5228
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                                                  PID:5436
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                                                      PID:5476
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                    PID:5500
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                                                                                                        PID:5600
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                            • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                            PID:5756
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                            PID:2064
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                              • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                              PID:3172
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                                                PID:4576
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3832
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                  choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                  61⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4704
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                        62⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                          PID:5368
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4576
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3308
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                    choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6180
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6188
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6364
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6544
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6640
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                              68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6736
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6728
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6816
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6824
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7072
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Accesses Microsoft Outlook profiles
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • outlook_office_path
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • outlook_win_path
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\choice.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            choice /C Y /N /D Y /T 3
                                                                                                                                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PI_160420PDF ARJ005634420200429 ,pdf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6472

                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\629ef54c-3340-c0d9-b3e9-4a1ac7501100
                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0e94f508a7733660f34dd8bdee3498be

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3ff9062790b9b2e5db956f1c5f76437db41a4872

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  557b364bfb2cb6e9af4bdb2dc00a8854ae502e2901bd2dd106af7197e0709116

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0f7ee5f3cffaa91c7588d23e4edc2cfb0605177d3d8ccbfe48f5f46e88ce350d55dc7f594d8acd2984976fa242e337454068585aadbe14dde85b9015ec96bd5a

                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\629ef54c-3340-c0d9-b3e9-4a1ac7501100
                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0e94f508a7733660f34dd8bdee3498be

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3ff9062790b9b2e5db956f1c5f76437db41a4872

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  557b364bfb2cb6e9af4bdb2dc00a8854ae502e2901bd2dd106af7197e0709116

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0f7ee5f3cffaa91c7588d23e4edc2cfb0605177d3d8ccbfe48f5f46e88ce350d55dc7f594d8acd2984976fa242e337454068585aadbe14dde85b9015ec96bd5a

                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                • memory/288-95-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/548-92-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/584-86-0x00000000001B0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/668-150-0x0000000000C05000-0x0000000000C16000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/668-84-0x0000000000C00000-0x0000000000C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/672-67-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/944-105-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1000-103-0x0000000000230000-0x0000000000280000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1104-60-0x0000000000400000-0x0000000000490000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  576KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1104-62-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1104-155-0x0000000004C05000-0x0000000004C16000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1104-61-0x0000000000640000-0x0000000000646000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1152-55-0x0000000000840000-0x000000000090A000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  808KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1152-56-0x00000000021C0000-0x0000000002258000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  608KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1152-57-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1152-58-0x0000000000340000-0x0000000000343000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1212-88-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1212-148-0x0000000004AC5000-0x0000000004AD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1224-97-0x00000000001F0000-0x0000000000240000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1476-77-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1476-154-0x0000000004B75000-0x0000000004B86000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1480-91-0x00000000001B0000-0x0000000000206000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  344KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1500-151-0x0000000000A05000-0x0000000000A16000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1500-72-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1536-70-0x00000000006C0000-0x00000000006C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1536-153-0x00000000006C5000-0x00000000006D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1600-126-0x00000000002C0000-0x0000000000306000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  280KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1612-66-0x00000000001F0000-0x0000000000240000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1616-80-0x00000000002F0000-0x00000000003A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  708KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1904-172-0x00000000001C0000-0x0000000000210000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1956-81-0x0000000000F40000-0x0000000000F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1956-158-0x0000000000F45000-0x0000000000F56000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1980-76-0x0000000000450000-0x0000000000480000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  192KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2180-104-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2180-152-0x00000000008A5000-0x00000000008B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2228-163-0x0000000001075000-0x0000000001086000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2228-123-0x0000000000F40000-0x0000000001071000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2260-174-0x0000000001055000-0x0000000001066000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2260-131-0x0000000001050000-0x0000000001051000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2280-107-0x00000000002B0000-0x0000000000340000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  576KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2376-108-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2556-112-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2556-149-0x0000000000AB5000-0x0000000000AC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2640-115-0x00000000002C0000-0x0000000000310000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2708-116-0x0000000000E10000-0x0000000000E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2720-128-0x0000000000360000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  768KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2736-137-0x0000000000EE0000-0x0000000001090000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2748-134-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2776-169-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2784-130-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2784-175-0x0000000004FE5000-0x0000000004FF6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2788-118-0x0000000000300000-0x0000000000350000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2868-160-0x0000000002595000-0x00000000025A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  68KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/2868-119-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3152-140-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3324-142-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3400-178-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3428-146-0x00000000001B0000-0x0000000000200000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3460-173-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3556-147-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3728-177-0x00000000003C0000-0x0000000000400000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3760-159-0x0000000004D40000-0x0000000004D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3852-162-0x0000000000370000-0x00000000003B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3888-165-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/3980-166-0x00000000002B0000-0x0000000000300000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                  Download