masslogger | 4ec753e5cafab6f687a4cda65a4509d3ecf15d4ea1bbd990e671ed00d66cbb8f

Analysis

max time kernel
151s
max time network
174s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL Shipment 7348255141.exe
Size

1.0MB
MD5

ec1721ef86c0f91cb52081731624f00b
SHA1

3e7900979980b88607b51f0a39faaaab5778eb6f
SHA256

c3678d87151b21e6a29ded035522c1c22950f97787e45b3df2dba52a4e688c97
SHA512

2fc3b09e286e427bd11ea822c3a55fce71c161b9cd1c8ab268eaa4214fcde3cfd73e54659c9fb3ea76d28145099811a9a30fcbf32f28e5cb6172afa0709d9f5b

Score

10^/10

masslogger collection ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:45:58 AM MassLogger Started: 5/21/2022 2:45:51 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:46:00 AM MassLogger Started: 5/21/2022 2:45:52 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:46:07 AM MassLogger Started: 5/21/2022 2:46:01 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Window Searcher ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:46:10 AM MassLogger Started: 5/21/2022 2:46:03 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Downloader ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:46:11 AM MassLogger Started: 5/21/2022 2:46:05 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Bot Killer ||> Disabled <|| Window Searcher ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.4.0.0 ||> User Name: Admin IP: 154.61.71.50 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:46:28 AM MassLogger Started: 5/21/2022 2:46:20 AM Interval: 1 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility Name:WerFault, Title:Microsoft .NET Assembly Registration Utility <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1124-61-0x0000000000400000-0x00000000004B8000-memory.dmp	family_masslogger

MassLogger log file 61 IoCs

Detects a log file produced by MassLogger.

resource	yara_rule
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
	masslogger_log_file
behavioral1/files/0x000800000001313a-159.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-155.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-158.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-157.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-156.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-164.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-163.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-162.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-161.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-160.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-166.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-169.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-168.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-167.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-171.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-172.dat	masslogger_log_file
behavioral1/files/0x000800000001313a-174.dat	masslogger_log_file
behavioral1/files/0x0012000000012761-176.dat	masslogger_log_file
behavioral1/files/0x000b00000001313a-240.dat	masslogger_log_file
behavioral1/files/0x000b00000001313a-239.dat	masslogger_log_file
behavioral1/files/0x000c00000001313a-245.dat	masslogger_log_file
behavioral1/files/0x000d00000001313a-252.dat	masslogger_log_file
behavioral1/files/0x000e00000001313a-255.dat	masslogger_log_file
behavioral1/files/0x000f00000001313a-259.dat	masslogger_log_file
behavioral1/files/0x001100000001313a-296.dat	masslogger_log_file
behavioral1/files/0x001200000001313a-300.dat	masslogger_log_file
behavioral1/files/0x001300000001313a-310.dat	masslogger_log_file
behavioral1/files/0x001400000001313a-323.dat	masslogger_log_file
behavioral1/files/0x001500000001313a-334.dat	masslogger_log_file
behavioral1/files/0x001600000001313a-335.dat	masslogger_log_file
behavioral1/files/0x001600000001313a-339.dat	masslogger_log_file
behavioral1/files/0x001700000001313a-347.dat	masslogger_log_file
behavioral1/files/0x001800000001313a-361.dat	masslogger_log_file
behavioral1/files/0x001900000001313a-377.dat	masslogger_log_file
behavioral1/files/0x001900000001313a-380.dat	masslogger_log_file
behavioral1/files/0x001900000001313a-382.dat	masslogger_log_file
behavioral1/files/0x001a00000001313a-391.dat	masslogger_log_file
behavioral1/files/0x001b00000001313a-404.dat	masslogger_log_file
behavioral1/files/0x001b00000001313a-405.dat	masslogger_log_file
behavioral1/files/0x001b00000001313a-409.dat	masslogger_log_file

Checks computer location settings 2 TTPs 64 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 64 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Looks up external IP address via web service 16 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
98	api.ipify.org
148	api.ipify.org
43	api.ipify.org
89	api.ipify.org
96	api.ipify.org
111	api.ipify.org
132	api.ipify.org
60	api.ipify.org
114	api.ipify.org
161	api.ipify.org
10	api.ipify.org
14	api.ipify.org
35	api.ipify.org
50	api.ipify.org
70	api.ipify.org
82	api.ipify.org

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1108 set thread context of 1076	1108	DHL Shipment 7348255141.exe	29
PID 584 set thread context of 664	584	DHL Shipment 7348255141.exe	32
PID 840 set thread context of 316	840	DHL Shipment 7348255141.exe	34
PID 868 set thread context of 284	868	DHL Shipment 7348255141.exe	36
PID 1220 set thread context of 928	1220	DHL Shipment 7348255141.exe	39
PID 1720 set thread context of 2036	1720	DHL Shipment 7348255141.exe	41
PID 468 set thread context of 2020	468	DHL Shipment 7348255141.exe	43
PID 1072 set thread context of 1492	1072	DHL Shipment 7348255141.exe	45
PID 528 set thread context of 1236	528	DHL Shipment 7348255141.exe	48
PID 1704 set thread context of 480	1704	DHL Shipment 7348255141.exe	50
PID 288 set thread context of 1604	288	DHL Shipment 7348255141.exe	52
PID 2004 set thread context of 2060	2004	DHL Shipment 7348255141.exe	54
PID 2128 set thread context of 2168	2128	DHL Shipment 7348255141.exe	57
PID 2232 set thread context of 2268	2232	DHL Shipment 7348255141.exe	59
PID 2344 set thread context of 2380	2344	DHL Shipment 7348255141.exe	61
PID 2472 set thread context of 2528	2472	DHL Shipment 7348255141.exe	63
PID 2704 set thread context of 2800	2704	DHL Shipment 7348255141.exe	66
PID 2948 set thread context of 2988	2948	DHL Shipment 7348255141.exe	69
PID 2632 set thread context of 2584	2632	DHL Shipment 7348255141.exe	72
PID 3024 set thread context of 1392	3024	DHL Shipment 7348255141.exe	74
PID 3144 set thread context of 3200	3144	DHL Shipment 7348255141.exe	90
PID 3244 set thread context of 3284	3244	DHL Shipment 7348255141.exe	92
PID 3388 set thread context of 3424	3388	DHL Shipment 7348255141.exe	94
PID 3512 set thread context of 3548	3512	DHL Shipment 7348255141.exe	96
PID 3596 set thread context of 3632	3596	DHL Shipment 7348255141.exe	98
PID 3696 set thread context of 3728	3696	DHL Shipment 7348255141.exe	100
PID 3788 set thread context of 3820	3788	DHL Shipment 7348255141.exe	102
PID 3904 set thread context of 3936	3904	DHL Shipment 7348255141.exe	104
PID 4004 set thread context of 4036	4004	DHL Shipment 7348255141.exe	106
PID 4092 set thread context of 1512	4092	DHL Shipment 7348255141.exe	108
PID 2320 set thread context of 3396	2320	DHL Shipment 7348255141.exe	110
PID 3408 set thread context of 3392	3408	DHL Shipment 7348255141.exe	114
PID 3372 set thread context of 3592	3372	DHL Shipment 7348255141.exe	117
PID 4072 set thread context of 3996	4072	DHL Shipment 7348255141.exe	119
PID 4200 set thread context of 4236	4200	DHL Shipment 7348255141.exe	123
PID 4688 set thread context of 4732	4688	DHL Shipment 7348255141.exe	136
PID 4992 set thread context of 5024	4992	DHL Shipment 7348255141.exe	139
PID 5064 set thread context of 5104	5064	DHL Shipment 7348255141.exe	141
PID 3368 set thread context of 4264	3368	DHL Shipment 7348255141.exe	144
PID 3948 set thread context of 4424	3948	DHL Shipment 7348255141.exe	146
PID 4316 set thread context of 4284	4316	DHL Shipment 7348255141.exe	148
PID 4360 set thread context of 4084	4360	DHL Shipment 7348255141.exe	150
PID 4204 set thread context of 4740	4204	DHL Shipment 7348255141.exe	152
PID 5060 set thread context of 5068	5060	DHL Shipment 7348255141.exe	154
PID 4216 set thread context of 4244	4216	DHL Shipment 7348255141.exe	156
PID 5092 set thread context of 4924	5092	DHL Shipment 7348255141.exe	158
PID 4724 set thread context of 4388	4724	DHL Shipment 7348255141.exe	160
PID 4728 set thread context of 3344	4728	DHL Shipment 7348255141.exe	162
PID 5020 set thread context of 2256	5020	DHL Shipment 7348255141.exe	164
PID 4700 set thread context of 5136	4700	DHL Shipment 7348255141.exe	166
PID 5236 set thread context of 5268	5236	DHL Shipment 7348255141.exe	168
PID 5380 set thread context of 5412	5380	DHL Shipment 7348255141.exe	170
PID 5528 set thread context of 5576	5528	DHL Shipment 7348255141.exe	173
PID 5760 set thread context of 5812	5760	DHL Shipment 7348255141.exe	177
PID 5924 set thread context of 5960	5924	DHL Shipment 7348255141.exe	180
PID 6056 set thread context of 6108	6056	DHL Shipment 7348255141.exe	182
PID 1156 set thread context of 5172	1156	DHL Shipment 7348255141.exe	185
PID 5808 set thread context of 5572	5808	DHL Shipment 7348255141.exe	188
PID 6032 set thread context of 6132	6032	DHL Shipment 7348255141.exe	191
PID 5948 set thread context of 5256	5948	DHL Shipment 7348255141.exe	193
PID 5420 set thread context of 6028	5420	DHL Shipment 7348255141.exe	197
PID 1788 set thread context of 6152	1788	DHL Shipment 7348255141.exe	199
PID 6268 set thread context of 6304	6268	DHL Shipment 7348255141.exe	201

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 47 IoCs

pid	pid_target	Process	procid_target
2880	316	WerFault.exe	34
3020	1492	WerFault.exe	45
2480	928	WerFault.exe	39
1476	2268	WerFault.exe	59
2624	1236	WerFault.exe	48
2476	2380	WerFault.exe	61
2588	2020	WerFault.exe	43
1240	2528	WerFault.exe	63
2740	2168	WerFault.exe	57
328	480	WerFault.exe	50
2928	1604	WerFault.exe	52
2860	2036	WerFault.exe	41
3000	1124	WerFault.exe	27
2576	2060	WerFault.exe	54
4148	3424	WerFault.exe	94
4156	3548	WerFault.exe	96
4432	3592	WerFault.exe	117
4440	4036	WerFault.exe	106
4456	3632	WerFault.exe	98
4448	3820	WerFault.exe	102
4496	3728	WerFault.exe	100
4484	3200	WerFault.exe	90
4508	3284	WerFault.exe	92
4580	1512	WerFault.exe	108
4588	1392	WerFault.exe	74
4596	2584	WerFault.exe	72
4952	3996	WerFault.exe	119
5488	4264	WerFault.exe	144
5680	4424	WerFault.exe	146
5844	5104	WerFault.exe	141
5304	4740	WerFault.exe	152
5952	4084	WerFault.exe	150
5992	4924	WerFault.exe	158
5468	5068	WerFault.exe	154
6392	5268	WerFault.exe	168
6688	5136	WerFault.exe	166
6900	5812	WerFault.exe	177
2772	5576	WerFault.exe	173
6288	5172	WerFault.exe	185
6848	6108	WerFault.exe	182
6060	6304	WerFault.exe	201
6260	6152	WerFault.exe	199
6220	6028	WerFault.exe	197
5640	5256	WerFault.exe	193
7680	6840	WerFault.exe	210
7996	7164	WerFault.exe	215
6276	7040	WerFault.exe	213

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe
1172	DHL Shipment 7348255141.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1172	DHL Shipment 7348255141.exe
1108	DHL Shipment 7348255141.exe
584	DHL Shipment 7348255141.exe
584	DHL Shipment 7348255141.exe
840	DHL Shipment 7348255141.exe
868	DHL Shipment 7348255141.exe
1220	DHL Shipment 7348255141.exe
1720	DHL Shipment 7348255141.exe
468	DHL Shipment 7348255141.exe
1072	DHL Shipment 7348255141.exe
1072	DHL Shipment 7348255141.exe
528	DHL Shipment 7348255141.exe
1704	DHL Shipment 7348255141.exe
288	DHL Shipment 7348255141.exe
2004	DHL Shipment 7348255141.exe
2004	DHL Shipment 7348255141.exe
2128	DHL Shipment 7348255141.exe
2232	DHL Shipment 7348255141.exe
2344	DHL Shipment 7348255141.exe
2472	DHL Shipment 7348255141.exe
2472	DHL Shipment 7348255141.exe
2704	DHL Shipment 7348255141.exe
2948	DHL Shipment 7348255141.exe
2632	DHL Shipment 7348255141.exe
2632	DHL Shipment 7348255141.exe
3024	DHL Shipment 7348255141.exe
3144	DHL Shipment 7348255141.exe
3144	DHL Shipment 7348255141.exe
3244	DHL Shipment 7348255141.exe
3388	DHL Shipment 7348255141.exe
3512	DHL Shipment 7348255141.exe
3596	DHL Shipment 7348255141.exe
3696	DHL Shipment 7348255141.exe
3788	DHL Shipment 7348255141.exe
3904	DHL Shipment 7348255141.exe
4004	DHL Shipment 7348255141.exe
4092	DHL Shipment 7348255141.exe
2320	DHL Shipment 7348255141.exe
2320	DHL Shipment 7348255141.exe
2320	DHL Shipment 7348255141.exe
3408	DHL Shipment 7348255141.exe
3372	DHL Shipment 7348255141.exe
3372	DHL Shipment 7348255141.exe
4072	DHL Shipment 7348255141.exe
4200	DHL Shipment 7348255141.exe
4688	DHL Shipment 7348255141.exe
4688	DHL Shipment 7348255141.exe
4992	DHL Shipment 7348255141.exe
5064	DHL Shipment 7348255141.exe
5064	DHL Shipment 7348255141.exe
3368	DHL Shipment 7348255141.exe
3948	DHL Shipment 7348255141.exe
4316	DHL Shipment 7348255141.exe
4360	DHL Shipment 7348255141.exe
4204	DHL Shipment 7348255141.exe
5060	DHL Shipment 7348255141.exe
4216	DHL Shipment 7348255141.exe
5092	DHL Shipment 7348255141.exe
4724	DHL Shipment 7348255141.exe
4728	DHL Shipment 7348255141.exe
5020	DHL Shipment 7348255141.exe
4700	DHL Shipment 7348255141.exe
5236	DHL Shipment 7348255141.exe
5380	DHL Shipment 7348255141.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1124	RegAsm.exe
Token: SeDebugPrivilege	1108	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1076	RegAsm.exe
Token: SeDebugPrivilege	584	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	664	RegAsm.exe
Token: SeDebugPrivilege	840	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	316	RegAsm.exe
Token: SeDebugPrivilege	868	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	284	RegAsm.exe
Token: SeDebugPrivilege	1220	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	928	RegAsm.exe
Token: SeDebugPrivilege	1720	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2036	RegAsm.exe
Token: SeDebugPrivilege	468	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2020	RegAsm.exe
Token: SeDebugPrivilege	1072	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1492	RegAsm.exe
Token: SeDebugPrivilege	528	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1236	RegAsm.exe
Token: SeDebugPrivilege	1704	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	480	RegAsm.exe
Token: SeDebugPrivilege	288	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1604	RegAsm.exe
Token: SeDebugPrivilege	2004	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2060	RegAsm.exe
Token: SeDebugPrivilege	2128	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2168	RegAsm.exe
Token: SeDebugPrivilege	2232	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2268	RegAsm.exe
Token: SeDebugPrivilege	2344	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2380	RegAsm.exe
Token: SeDebugPrivilege	2472	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2528	RegAsm.exe
Token: SeDebugPrivilege	2704	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2800	RegAsm.exe
Token: SeDebugPrivilege	2948	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2988	RegAsm.exe
Token: SeDebugPrivilege	2632	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	2584	RegAsm.exe
Token: SeDebugPrivilege	3024	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1392	RegAsm.exe
Token: SeDebugPrivilege	3144	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3200	RegAsm.exe
Token: SeDebugPrivilege	3244	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3284	RegAsm.exe
Token: SeDebugPrivilege	3388	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3424	RegAsm.exe
Token: SeDebugPrivilege	3512	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3548	RegAsm.exe
Token: SeDebugPrivilege	3596	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3632	RegAsm.exe
Token: SeDebugPrivilege	3696	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3728	RegAsm.exe
Token: SeDebugPrivilege	3788	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3820	RegAsm.exe
Token: SeDebugPrivilege	3904	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3936	RegAsm.exe
Token: SeDebugPrivilege	4004	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	4036	RegAsm.exe
Token: SeDebugPrivilege	4092	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	1512	RegAsm.exe
Token: SeDebugPrivilege	2320	DHL Shipment 7348255141.exe
Token: SeDebugPrivilege	3396	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1124	1172	DHL Shipment 7348255141.exe	27
PID 1172 wrote to memory of 1108	1172	DHL Shipment 7348255141.exe	28
PID 1172 wrote to memory of 1108	1172	DHL Shipment 7348255141.exe	28
PID 1172 wrote to memory of 1108	1172	DHL Shipment 7348255141.exe	28
PID 1172 wrote to memory of 1108	1172	DHL Shipment 7348255141.exe	28
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 1076	1108	DHL Shipment 7348255141.exe	29
PID 1108 wrote to memory of 584	1108	DHL Shipment 7348255141.exe	30
PID 1108 wrote to memory of 584	1108	DHL Shipment 7348255141.exe	30
PID 1108 wrote to memory of 584	1108	DHL Shipment 7348255141.exe	30
PID 1108 wrote to memory of 584	1108	DHL Shipment 7348255141.exe	30
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 268	584	DHL Shipment 7348255141.exe	31
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 664	584	DHL Shipment 7348255141.exe	32
PID 584 wrote to memory of 840	584	DHL Shipment 7348255141.exe	33
PID 584 wrote to memory of 840	584	DHL Shipment 7348255141.exe	33
PID 584 wrote to memory of 840	584	DHL Shipment 7348255141.exe	33
PID 584 wrote to memory of 840	584	DHL Shipment 7348255141.exe	33
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 316	840	DHL Shipment 7348255141.exe	34
PID 840 wrote to memory of 868	840	DHL Shipment 7348255141.exe	35
PID 840 wrote to memory of 868	840	DHL Shipment 7348255141.exe	35
PID 840 wrote to memory of 868	840	DHL Shipment 7348255141.exe	35
PID 840 wrote to memory of 868	840	DHL Shipment 7348255141.exe	35
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 284	868	DHL Shipment 7348255141.exe	36
PID 868 wrote to memory of 1220	868	DHL Shipment 7348255141.exe	38

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1212
    3⤵
    - Program crash
    PID:3000
- C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:584
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:268
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      PID:664
  - - C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:840
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 1396
        6⤵
        Program crash
        
        PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:868
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:284
      - C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 1200
        8⤵
        Program crash
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 1220
        9⤵
        Program crash
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1208
        10⤵
        Program crash
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        9⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1208
        11⤵
        Program crash
        
        PID:3020
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        10⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        11⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1216
        12⤵
        Program crash
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        11⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        12⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 1244
        13⤵
        Program crash
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        12⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:288
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1260
        14⤵
        Program crash
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        13⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        14⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1248
        15⤵
        Program crash
        
        PID:2576
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        14⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        14⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        15⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 1256
        16⤵
        Program crash
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        15⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        16⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1256
        17⤵
        Program crash
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        16⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1236
        18⤵
        Program crash
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        17⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        18⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1228
        19⤵
        Program crash
        
        PID:1240
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        18⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        18⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        19⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        19⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        20⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        20⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        21⤵
        
        PID:3004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        21⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1220
        22⤵
        Program crash
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        21⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        22⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1212
        23⤵
        Program crash
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        22⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        23⤵
        
        PID:3188
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1216
        24⤵
        Program crash
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        23⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        24⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 1252
        25⤵
        Program crash
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        24⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3388
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1380
        26⤵
        Program crash
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        25⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        26⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 1380
        27⤵
        Program crash
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        26⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        27⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1376
        28⤵
        Program crash
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        27⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        28⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 1384
        29⤵
        Program crash
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        28⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3788
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 1376
        30⤵
        Program crash
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        29⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        30⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        30⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:4004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1380
        32⤵
        Program crash
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        31⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        32⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 1232
        33⤵
        Program crash
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        32⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:2320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        33⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        33⤵
        
        PID:3380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        33⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        33⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3408
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        34⤵
        Checks computer location settings
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        34⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3372
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        35⤵
        
        PID:3536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        35⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 1380
        36⤵
        Program crash
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        35⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        36⤵
        Checks computer location settings
        
        PID:3996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1396
        37⤵
        Program crash
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        36⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4200
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        37⤵
        Checks computer location settings
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        37⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4688
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        38⤵
        
        PID:4724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        38⤵
        Checks computer location settings
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        38⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        39⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        39⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5064
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        40⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 1248
        41⤵
        Program crash
        
        PID:5844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        40⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        40⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3368
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        41⤵
        Checks computer location settings
        
        PID:4264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 1392
        42⤵
        Program crash
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        41⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        42⤵
        Checks computer location settings
        
        PID:4424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1388
        43⤵
        Program crash
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        42⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4316
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        43⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        43⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4360
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        44⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:4084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1244
        45⤵
        Program crash
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        44⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4204
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        45⤵
        Checks computer location settings
        
        PID:4740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1388
        46⤵
        Program crash
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        45⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        46⤵
        Checks computer location settings
        
        PID:5068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1436
        47⤵
        Program crash
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        46⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4216
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        47⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        47⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5092
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        48⤵
        Checks computer location settings
        
        PID:4924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1392
        49⤵
        Program crash
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        48⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        49⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        49⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4728
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        50⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        50⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5020
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        51⤵
        Accesses Microsoft Outlook profiles
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        51⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4700
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        52⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 1428
        53⤵
        Program crash
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        52⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5236
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        53⤵
        Checks computer location settings
        
        PID:5268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 1388
        54⤵
        Program crash
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        53⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        54⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        54⤵
        Suspicious use of SetThreadContext
        
        PID:5528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        55⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 1428
        56⤵
        Program crash
        
        PID:2772
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        55⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        55⤵
        Suspicious use of SetThreadContext
        
        PID:5760
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        56⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 1392
        57⤵
        Program crash
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        56⤵
        Suspicious use of SetThreadContext
        
        PID:5924
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        57⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        57⤵
        Suspicious use of SetThreadContext
        
        PID:6056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        58⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:6108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 1432
        59⤵
        Program crash
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        58⤵
        Suspicious use of SetThreadContext
        
        PID:1156
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        59⤵
        Checks computer location settings
        
        PID:5172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 1392
        60⤵
        Program crash
        
        PID:6288
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        59⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        59⤵
        Suspicious use of SetThreadContext
        
        PID:5808
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        60⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        60⤵
        Suspicious use of SetThreadContext
        
        PID:6032
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        61⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        61⤵
        Suspicious use of SetThreadContext
        
        PID:5948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        62⤵
        Checks computer location settings
        
        PID:5256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 1392
        63⤵
        Program crash
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        62⤵
        Suspicious use of SetThreadContext
        
        PID:5420
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        63⤵
        Checks computer location settings
        
        PID:6028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 1380
        64⤵
        Program crash
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        63⤵
        Suspicious use of SetThreadContext
        
        PID:1788
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        64⤵
        Checks computer location settings
        
        PID:6152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 1384
        65⤵
        Program crash
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        64⤵
        Suspicious use of SetThreadContext
        
        PID:6268
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        65⤵
        Checks computer location settings
        
        PID:6304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6304 -s 1384
        66⤵
        Program crash
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        65⤵
        
        PID:6472
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        66⤵
        Checks computer location settings
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        66⤵
        
        PID:6620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        67⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:6664
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        67⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        67⤵
        
        PID:6808
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        68⤵
        Checks computer location settings
        
        PID:6840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 1396
        69⤵
        Program crash
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        68⤵
        
        PID:6992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        69⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:7040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1432
        70⤵
        Program crash
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        69⤵
        
        PID:7132
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        70⤵
        Checks computer location settings
        
        PID:7164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 1392
        71⤵
        Program crash
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        70⤵
        
        PID:5308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        71⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        71⤵
        
        PID:5936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        72⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        72⤵
        
        PID:6776
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        73⤵
        Checks computer location settings
        outlook_office_path
        outlook_win_path
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        73⤵
        
        PID:7000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        74⤵
        Checks computer location settings
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        74⤵
        
        PID:7300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        75⤵
        
        PID:7328
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        75⤵
        Checks computer location settings
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        75⤵
        
        PID:7396
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        76⤵
        Checks computer location settings
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        76⤵
        
        PID:7536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        77⤵
        
        PID:7588
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        77⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        77⤵
        
        PID:7768
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        78⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        78⤵
        
        PID:7888
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        79⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        79⤵
        
        PID:8080
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        80⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        80⤵
        
        PID:7208
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        81⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        81⤵
        
        PID:7560
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        82⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        82⤵
        
        PID:7748
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        83⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        83⤵
        
        PID:7764
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        84⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        84⤵
        
        PID:8168
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        85⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        85⤵
        
        PID:8148
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        86⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"
        86⤵
        
        PID:7260
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        87⤵
        
        PID:4796
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        87⤵
        
        PID:4788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
c795a91d1886d7349eaa8a945fcd75b6

SHA1
f3479530761f3b76a9c23b0a3a2182b687524c79

SHA256
033c8193aef801b3d364935b5aa425c18fe0c609ed02a02b08581015a4edacf0

SHA512
4119c0be480777ae0de8ac7a110cac87045a12ccefec4eb8e700da6c5bafdec35663d103ee1b73ea49dcbfbe19a2cf83913de92dfd1edcffb37f04736a16a9d9

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
a5a4aa16131eae9e2815c793495b3317

SHA1
bea17f8e22d4b219f4faeb73eefc295779df611d

SHA256
b1cc8d45189f6b71d2273dde9f66b00026c362768d2a67943c122f3aaf711ee5

SHA512
7d859936143889e3a7da7f666dea15ac3b382d82f5390dc4ef35aaf5d9e86302973836e7b3519e29a3dee5f40419f832fc7bf8fe3c07691f9861626771e2641b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
f6f9f667091b907c39eb82ef1766dc86

SHA1
6e11e8cd01411e1ef631b1e251e0ff3731269a65

SHA256
536c4eb600d619794277586401a7f4e012fc86a8b3ac4147d7f9a891f9607342

SHA512
e38d752d5e2efb89f0aedb50465b5d1d0f4b8f3076cdf8ac7eb67e864dfda0304f1b610a63c0faaf158a3698a9bfa07a7d55d4ea259a62af57869e915e8c3b48

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
88a961d510427a6cd744180f69625257

SHA1
d52ee509aa374f574ebcd0edc918d28160eb6d8f

SHA256
d0d1aba7411f52f3458c52876d08798282b8d54f354efca1df5b8895dbcbe045

SHA512
1b607a58b3bea9cc853197198fb238104dca87c749eb03d29a169d6a352a2e417383471831499effbc3906457e6ff66c63eec20e40fcbf7e4be14e92440971ed

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
88a961d510427a6cd744180f69625257

SHA1
d52ee509aa374f574ebcd0edc918d28160eb6d8f

SHA256
d0d1aba7411f52f3458c52876d08798282b8d54f354efca1df5b8895dbcbe045

SHA512
1b607a58b3bea9cc853197198fb238104dca87c749eb03d29a169d6a352a2e417383471831499effbc3906457e6ff66c63eec20e40fcbf7e4be14e92440971ed

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
6a4a5e7774dec5cd51fce6ce8ec6c491

SHA1
8f4ae21f7dad495066714870cb5424289fbe07e6

SHA256
7d90b641c4a822c67e1b9716d4ea6ba04a725562d7287b701bab0f7bafde78f6

SHA512
5c4aec8d973b1d02405efa4662427161d2bf9098ff7742642cbab696891c82a3959af154c75f9ef12a19383b1db355920f1df27d53f36da3ec725204a1d0c2b5

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
6a4a5e7774dec5cd51fce6ce8ec6c491

SHA1
8f4ae21f7dad495066714870cb5424289fbe07e6

SHA256
7d90b641c4a822c67e1b9716d4ea6ba04a725562d7287b701bab0f7bafde78f6

SHA512
5c4aec8d973b1d02405efa4662427161d2bf9098ff7742642cbab696891c82a3959af154c75f9ef12a19383b1db355920f1df27d53f36da3ec725204a1d0c2b5

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
6a4a5e7774dec5cd51fce6ce8ec6c491

SHA1
8f4ae21f7dad495066714870cb5424289fbe07e6

SHA256
7d90b641c4a822c67e1b9716d4ea6ba04a725562d7287b701bab0f7bafde78f6

SHA512
5c4aec8d973b1d02405efa4662427161d2bf9098ff7742642cbab696891c82a3959af154c75f9ef12a19383b1db355920f1df27d53f36da3ec725204a1d0c2b5

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
3921874d9524ecec1053aad4e8a564dc

SHA1
187d891a75e25599570ff3d8c2f13906f890ae3e

SHA256
c2cd7efd1f89b4d6dd0d978cd4c739ea2f5fc7d649bb0c805642b579c1c79740

SHA512
786791b76d57e8a881eeeb3427c9cb11a5d51e1f38696c0ae8af027ad783a1da5ab6aed56f187673eb341c95bd646de90faf5aa68414027b9f5570493c26e3de

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
a1aca3567b598fa282eb843658f11585

SHA1
d2a68ec6e2f22462c6a27011a0ae969c4b361d41

SHA256
317ee5badf0e31aa4398a6b71f9797e2514b705287131acb8777593fa9c8f8cb

SHA512
b03fdafaa6ff4c51cb79314128214a98db1d3ceb933b68e5d343705d8fbb24655b756f3995c336d153c430cb02fe15f4fbbacab0581605a1abd7157947371648

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
14600046936115a3dfa9f3f2a246e374

SHA1
8cfef736ff86def443f9f2afb520736acb2d1da7

SHA256
5c5432499464d258ae90cd3d43c6d3ee693c35e87216d64cce781a3e51f54595

SHA512
af668f53967e0ada8d5fd825cf5e8c7b9e38f4c05747392ffb4c033163c4f5e80c61644b76e9d4d41155745a3035a8422c08cf4889f577e08bb88f0cf17954f6

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
575537960c1ce8c18f3824d315be9f61

SHA1
b3795a8775e11ce773b146b11af283f6880b1e12

SHA256
b75385f66b0065dda6f7ba9e2050e9b8048a7d552f0d7435d9a165d94c66acd1

SHA512
88900ded0da366fc2a4147b24f1d2c5e853637fd252ad7b89093bd8be1f24c1ab6aa9f766847f8e923058aa09c3e955a03ac8ce6375666e69e9295bbaca5b799

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
1KB

MD5
d3a01cfe5f385b1c31c93de439cc045f

SHA1
e9c00dc4391419bce06327f8f0220cac346ce6c9

SHA256
bbf0b5c8f1dabb19ebe322a5280b40297d4c33e479928331d26b552d0200f184

SHA512
a461b5bce4c2c59e6be2db0ca2c4ae9ee57e6f706b2ab0b2edd2ab928f16b7760c627ac5715f554acabc90c9309d2172605e53e369bf17f8cc01a052b99357a5

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
2KB

MD5
9b5bdd72fa9a674b5a3ee511b9fe9b3e

SHA1
8997dc9674934c4f518364d005fcce6c614cf622

SHA256
2d44dc7af004596e9b3ea386707c54e40ce31cf3c962ae083b8a70ba5508f106

SHA512
8fc987f30beeacc5f5c8eff853ef828944db78ff9dfc91215f2ad0e481688e29b4ed36bb679d813edafd6d2e1e176d307a8b78d3639557c123e20f04c60de8be

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
4b57968098029ca71527eccb35697e0c

SHA1
47a522706a95472a51e1724bf65ecb38f6124d34

SHA256
81fe519bdd26b3d3f646f0f923e488b5e5dcb5137092fdf24479b1f519208fbe

SHA512
81757d8f5eafcf7252651c1c210b942632daa4695fb42493f3413cde2a0d0b4887b68829f39409a13fb57565ef105151a8ecba58984e2516dec67c16382f9231

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
9cb0e25e2688290843a9990d2c6f6d42

SHA1
1b00f82770db3c2fd5d8fd1a9db6b8db82684c98

SHA256
a77d1a2010f46ce1a0f78318c3eb049d331f59150b4b6ae9fb5d7971898c68c0

SHA512
99d1a71e139aaf417decacebeb59ebd413e05f9f41349a2c8d8a10e290cc59511d575f935663738a4def331026d0b755239ed2856273c8994ff9547dfd648bf5

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
6b8833ee5e01e88aff0e969533dd3e77

SHA1
c41f5857cad5f5e1360bfe9584173555576a0b6a

SHA256
f71b71bc1b67522c36a087ad30e67bc21084a5459d9ca5200188e6fe159324e1

SHA512
377513df7c350730c88d9523d656557d6e9de220c1a2813a0dc3f6e9a4f1d89b234f5043ee6e4f9ff7bd95a6975eb1d4fdb407c2b8309b3dcf80c174df61e823

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
4f4703e4426d7d81aefb9117f0c7888f

SHA1
8c24a409beb06a50c43bbd8c3b2c3076a00ba528

SHA256
f8999b7e8174206def9c02bae34b1b94a82d2117360ad60c71752fae4d3eef45

SHA512
c1b3b9b77b522443bf3daa1ad0c075c7e4c20496d240e99304e143bd1f1360f621f8fd17b0bb3b25d074f376672cb50065e0bbf3485cd425f11896f3c8aa6739

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
4f4703e4426d7d81aefb9117f0c7888f

SHA1
8c24a409beb06a50c43bbd8c3b2c3076a00ba528

SHA256
f8999b7e8174206def9c02bae34b1b94a82d2117360ad60c71752fae4d3eef45

SHA512
c1b3b9b77b522443bf3daa1ad0c075c7e4c20496d240e99304e143bd1f1360f621f8fd17b0bb3b25d074f376672cb50065e0bbf3485cd425f11896f3c8aa6739

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
5f1c3d48125c28b76a3f933e1cf0e87b

SHA1
0b29b6f6d3044daf13c316319aec514ed48712b5

SHA256
7ff3cf8a9c9ccf8c1f7c9ccaf982f0ac2ebd2f4a8a88b6538293cc083d7a1dcd

SHA512
4c76096e775129e0ed5ef562bbe2d9b7a420e35e39ac1d44dc9a32d2704e6f8ce636884ca11dfcf2fb97012a48f67cb446f796966e77d2feb526b6772b27d75d

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
91edf8a0ff458f70a60d8c634b84dff8

SHA1
f36e38a5205e7b62ebeec101ad43aa0d48149dda

SHA256
19d7e5d454544e28d49de68c6e4c343ec1c80dee78a1e792709d3067ceafdec0

SHA512
fa254986c52585aaff8f9ae4a5f4cf8d3ca118714d70a4ed392de6dc1295ac712d08ed3916669037402ed6ccb1eed79b9572a84b0ffdd0db7aa597596118ca8b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
3KB

MD5
438d210e55e6c20569387798db714e4c

SHA1
26026fe2a79d3df9886d8d6a8fd623c09c62fe2e

SHA256
02a7333b4595cb9d8cbbfbf3a403503648f5473f107fcf784c3342fec4d4c8f8

SHA512
1e96f39c4195494edf7eeb0c4f9f06083b9b33c27d6b93382409cf2811bc057eff49e0635cfa3e7fc8a13499d12d46647ab7be49f8c34b898548fff88949401c

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
4KB

MD5
da86ad2fa392b7d035cc697b68b72850

SHA1
5c2ad13270af84c6cebfdefb6b25135d50e72ced

SHA256
4e3f0a7d0c87882bb9f6a9eaa25d837f9cf7ad4cec13597a9fe87927143e3cf3

SHA512
543e0be906dbbc2ec6854853e7c5efc3dd6bd55552f65b697fffe1b606670949488cad75d55690ecea910a0788ec0bde862bd5dce627a7bcc9be25ad0a61e13b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
4KB

MD5
da86ad2fa392b7d035cc697b68b72850

SHA1
5c2ad13270af84c6cebfdefb6b25135d50e72ced

SHA256
4e3f0a7d0c87882bb9f6a9eaa25d837f9cf7ad4cec13597a9fe87927143e3cf3

SHA512
543e0be906dbbc2ec6854853e7c5efc3dd6bd55552f65b697fffe1b606670949488cad75d55690ecea910a0788ec0bde862bd5dce627a7bcc9be25ad0a61e13b

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
4KB

MD5
33c2e9abc0f0de024afdcccf4c556293

SHA1
616732712d76a65770962506997c20393659cd79

SHA256
200a7c6fdace32c5aa7a85e48e53fc8b7bbf32b14a84e6a880b920b42de15f45

SHA512
67a6f2399baebfc84d76564bc37629cf1caeefe72705c3aaa4a789c3e6f2a724384faf963b7014a46596c283f3bf0151aafbe0c3e121c891720567543b896009

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
4KB

MD5
da2836bc447dc594b8f696a92a99dd7c

SHA1
71308e690504a95aa89f91ec3924573a4abe715a

SHA256
6f0f06719daf0ea132b0b922ce2f3cf5b83846e4218a41986f8ccdc6ac6703a0

SHA512
73a961a8d0218d1a63f920f6e76a3c1e8448b176002228f61e2ede0069a0b38fdb9631cde8c96e1d6400fd85452bfa105ee3171ed2371341ed40c479c6cb4acb

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
4KB

MD5
c6d1d371d4c31ccee210045211e85fe6

SHA1
3d7088a2b7411abcda7022c6505df19668538b04

SHA256
58ca0ed83f8c712b0f2fef525d56f8fae2872f1ffb936fb3a71f7280289b7988

SHA512
59de809038d38e0afa1ef957e8be120fd6deadc38a3c10392f8a93c1f9dd190a9e3e688b9cd99e6579df7109b428828726084806a0f3236e9057773535ea264c

Download Submit
C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Filesize
4KB

MD5
c6d1d371d4c31ccee210045211e85fe6

SHA1
3d7088a2b7411abcda7022c6505df19668538b04

SHA256
58ca0ed83f8c712b0f2fef525d56f8fae2872f1ffb936fb3a71f7280289b7988

SHA512
59de809038d38e0afa1ef957e8be120fd6deadc38a3c10392f8a93c1f9dd190a9e3e688b9cd99e6579df7109b428828726084806a0f3236e9057773535ea264c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.45.33.zip

Filesize
1KB

MD5
c062c12584f6c92629015fa983e375eb

SHA1
246b0e8ab038771656e728eb84b519648866f5d8

SHA256
a56b9bae0fbf49bf7888125831459e0df86cc3eccf74dcc3f4f83f7ca846a5e6

SHA512
58924d9a82a8fd49111ec5a0af974d7d26eb4e157ee0d2ca17bf2f0300d597393bf572b3b5330edb9cbcf1b6a488c9f9e967853ab3da1c336f14060ad619a48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.45.33.zip

Filesize
1KB

MD5
5176408499f5232445e94d5522821fcc

SHA1
d5af0064df35708ceb1840ca7df43207846fe457

SHA256
82e3a609814dfc91227ff4aca1fb8314e314ca90dc916d27d313b7e9b13111bf

SHA512
59728a09575276a11b6cc2e1874189947969f11287c8a01563fc20e3f4f2d73ff3b496b8c900227786d3c3047c69b283895cc80598acb5ee2b854e1e236a9fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.45.33.zip

Filesize
1KB

MD5
757a763e2f775201955fc0c9d7442375

SHA1
fd7f25326efbade5ec765697ad3d704a6af49f14

SHA256
39fd15cf19229e4c34ee63928aa7be69037d2e1ae66f8fad7102761e78496676

SHA512
e0d4e0f303f89451917d07b63e57dfcda17c73021e70d5e0337061c666b4876845ecd208e093179b5185ca3d2d2210b8bdc8dc7d435a7e8b16f9c9261f3644de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.46.54.zip

Filesize
1KB

MD5
2495400d874f84a94862d5a2fe3a6b15

SHA1
a8dd0e9df9ec200b467be17110f8b29ad5ba59d1

SHA256
173b751cdc1a7da27894896ec5c906535a53e479e7a6b6e732823fd9e127f151

SHA512
3d35c7a7b2f39d34eb7c65a42d6f2081426823c84194f4340e19ab9d0ac7ebdffa86e853d1d40ac7fcd188a3fe5114be860de29ea2b440dfa9f32c0677444eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.46.54.zip

Filesize
1KB

MD5
dfa1338f2a096e76547ab2d89b2e92ea

SHA1
5e2cb52a12949c6f23dc5f34b9932a0499649e1a

SHA256
c8dc61f77c5c3b1e1197bc7d584925576124aa1fd58b594e118219446f5b1a27

SHA512
10191c66bec279042882a141e16ac0beec1e8cb00ea09cc7dd4f891593656f2dc0e61d49dc8f1436409d00eb0db8358033fe0fad60241cc41d35fc73c9be9cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.47.11.zip

Filesize
1KB

MD5
fe82ff71a0bdbe49014e4abba0a6ec22

SHA1
c2d36057756c1b2e4a99a455665f6d5b291061d7

SHA256
5d7464bac808558ffeee0b5c7bc9e7ee34078ab05f4f0d00b69aab64ff305a73

SHA512
f548a07219e6d7f668f46c65c561fcbf450245836de41345facd51115009c905ec3c2c3f552315691656528d520a826b6e6f0d5f0c859640bd53f47c09f0bd2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.47.11.zip

Filesize
1KB

MD5
12adbd5ab48f9c0d7e27790cfc26d7bd

SHA1
1982b3c556be631f7d292c690b3a708e3e26ccac

SHA256
13eb78cd51362737ce1859bf2e2f5f3a611fb62bb595677e7f81c5bdfbdddb25

SHA512
e33a7550deb94a1c59b0a67dabcd03e2d6903ea95da6946aad70b553ed7cbfce7e55d448aa8201e3169af82f5891f58791cb25fbc366d2a2b6fc7182db842b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.47.21.zip

Filesize
1KB

MD5
24d7975e4a881c2fdb2c7eff03365933

SHA1
d87f6613a5a9f5da94d71abaa874406a8089290d

SHA256
e07d320c9312de7657f6bc97fa116a967f17a76ffe2591b61aa2f63ad97da34f

SHA512
4bb93f45d99d2682c75f3004e602785f2ab4cf2ed699ec95584f3b734185fbd36b6648f79f322c3f07638a1a2945980b69d7fa58cd777e268ee396a244c0df9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin_United States_AEF946DCB4_05-21-2022 2.47.21.zip

Filesize
1KB

MD5
cad0dc0da4c3009443df9800c0f8b6d9

SHA1
dfc37bcbeb7f589a86948b80d654d2de24255418

SHA256
4afdb308997d4369698766754b2bce4b050866f57f000964de12d765716a8e27

SHA512
a4417b2952d169929fc0a938beb5507d015eb8397e08c736ff5b8fef3aa86c49792c0a3c98149c4ef2c17e75d182c0f762e767118b523b52f557a6dde179340a

Download Submit
memory/284-139-0x0000000004D65000-0x0000000004D76000-memory.dmp

Filesize
68KB

Download
memory/316-137-0x00000000007E5000-0x00000000007F6000-memory.dmp

Filesize
68KB

Download
memory/480-146-0x0000000002505000-0x0000000002516000-memory.dmp

Filesize
68KB

Download
memory/664-138-0x0000000000A85000-0x0000000000A96000-memory.dmp

Filesize
68KB

Download
memory/928-140-0x0000000000D25000-0x0000000000D36000-memory.dmp

Filesize
68KB

Download
memory/1076-135-0x00000000009A5000-0x00000000009B6000-memory.dmp

Filesize
68KB

Download
memory/1124-136-0x00000000024C5000-0x00000000024D6000-memory.dmp

Filesize
68KB

Download
memory/1124-62-0x0000000000A20000-0x0000000000A98000-memory.dmp

Filesize
480KB

Download
memory/1124-61-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1172-56-0x00000000048D0000-0x0000000004990000-memory.dmp

Filesize
768KB

Download
memory/1172-54-0x0000000000960000-0x0000000000A6C000-memory.dmp

Filesize
1.0MB

Download
memory/1172-55-0x0000000000860000-0x0000000000920000-memory.dmp

Filesize
768KB

Download
memory/1172-57-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1172-58-0x0000000000350000-0x0000000000353000-memory.dmp

Filesize
12KB

Download
memory/1236-145-0x0000000004E85000-0x0000000004E96000-memory.dmp

Filesize
68KB

Download
memory/1392-236-0x0000000000C75000-0x0000000000C86000-memory.dmp

Filesize
68KB

Download
memory/1492-144-0x00000000004F5000-0x0000000000506000-memory.dmp

Filesize
68KB

Download
memory/1512-250-0x0000000000C45000-0x0000000000C56000-memory.dmp

Filesize
68KB

Download
memory/1604-147-0x0000000004EC5000-0x0000000004ED6000-memory.dmp

Filesize
68KB

Download
memory/2020-143-0x0000000004D25000-0x0000000004D36000-memory.dmp

Filesize
68KB

Download
memory/2036-141-0x0000000004F35000-0x0000000004F46000-memory.dmp

Filesize
68KB

Download
memory/2060-148-0x0000000004CE5000-0x0000000004CF6000-memory.dmp

Filesize
68KB

Download
memory/2168-149-0x0000000000E65000-0x0000000000E76000-memory.dmp

Filesize
68KB

Download
memory/2256-328-0x0000000004ED5000-0x0000000004EE6000-memory.dmp

Filesize
68KB

Download
memory/2268-151-0x0000000004DE5000-0x0000000004DF6000-memory.dmp

Filesize
68KB

Download
memory/2380-152-0x0000000000BA5000-0x0000000000BB6000-memory.dmp

Filesize
68KB

Download
memory/2528-153-0x0000000004EA5000-0x0000000004EB6000-memory.dmp

Filesize
68KB

Download
memory/2584-230-0x0000000001295000-0x00000000012A6000-memory.dmp

Filesize
68KB

Download
memory/2800-154-0x00000000026D5000-0x00000000026E6000-memory.dmp

Filesize
68KB

Download
memory/2988-173-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/3200-235-0x0000000000D95000-0x0000000000DA6000-memory.dmp

Filesize
68KB

Download
memory/3284-237-0x0000000000B35000-0x0000000000B46000-memory.dmp

Filesize
68KB

Download
memory/3344-327-0x0000000004D55000-0x0000000004D66000-memory.dmp

Filesize
68KB

Download
memory/3392-253-0x0000000000B35000-0x0000000000B46000-memory.dmp

Filesize
68KB

Download
memory/3396-251-0x0000000000345000-0x0000000000356000-memory.dmp

Filesize
68KB

Download
memory/3424-238-0x0000000005095000-0x00000000050A6000-memory.dmp

Filesize
68KB

Download
memory/3548-241-0x0000000004D45000-0x0000000004D56000-memory.dmp

Filesize
68KB

Download
memory/3592-254-0x0000000004E05000-0x0000000004E16000-memory.dmp

Filesize
68KB

Download
memory/3632-242-0x0000000002435000-0x0000000002446000-memory.dmp

Filesize
68KB

Download
memory/3728-244-0x00000000006E5000-0x00000000006F6000-memory.dmp

Filesize
68KB

Download
memory/3820-243-0x0000000004FB5000-0x0000000004FC6000-memory.dmp

Filesize
68KB

Download
memory/3936-246-0x0000000002425000-0x0000000002436000-memory.dmp

Filesize
68KB

Download
memory/3996-258-0x0000000004AC5000-0x0000000004AD6000-memory.dmp

Filesize
68KB

Download
memory/4036-247-0x0000000004E05000-0x0000000004E16000-memory.dmp

Filesize
68KB

Download
memory/4084-307-0x0000000004D05000-0x0000000004D16000-memory.dmp

Filesize
68KB

Download
memory/4236-274-0x0000000000E05000-0x0000000000E16000-memory.dmp

Filesize
68KB

Download
memory/4244-317-0x0000000004BC5000-0x0000000004BD6000-memory.dmp

Filesize
68KB

Download
memory/4264-297-0x00000000006A5000-0x00000000006B6000-memory.dmp

Filesize
68KB

Download
memory/4284-304-0x0000000004E75000-0x0000000004E86000-memory.dmp

Filesize
68KB

Download
memory/4388-326-0x0000000004FA5000-0x0000000004FB6000-memory.dmp

Filesize
68KB

Download
memory/4424-303-0x0000000004705000-0x0000000004716000-memory.dmp

Filesize
68KB

Download
memory/4732-287-0x0000000000BE5000-0x0000000000BF6000-memory.dmp

Filesize
68KB

Download
memory/4740-308-0x0000000000B25000-0x0000000000B36000-memory.dmp

Filesize
68KB

Download
memory/4924-322-0x0000000004D75000-0x0000000004D86000-memory.dmp

Filesize
68KB

Download
memory/5024-293-0x0000000000D65000-0x0000000000D76000-memory.dmp

Filesize
68KB

Download
memory/5068-314-0x0000000000815000-0x0000000000826000-memory.dmp

Filesize
68KB

Download
memory/5104-292-0x0000000004CE5000-0x0000000004CF6000-memory.dmp

Filesize
68KB

Download
memory/5136-333-0x0000000000DC5000-0x0000000000DD6000-memory.dmp

Filesize
68KB

Download
memory/5172-360-0x0000000004C55000-0x0000000004C66000-memory.dmp

Filesize
68KB

Download
memory/5268-340-0x0000000000CE5000-0x0000000000CF6000-memory.dmp

Filesize
68KB

Download
memory/5412-341-0x0000000004D95000-0x0000000004DA6000-memory.dmp

Filesize
68KB

Download
memory/5576-344-0x0000000002405000-0x0000000002416000-memory.dmp

Filesize
68KB

Download
memory/5812-351-0x0000000004F05000-0x0000000004F16000-memory.dmp

Filesize
68KB

Download
memory/5960-352-0x0000000000E35000-0x0000000000E46000-memory.dmp

Filesize
68KB

Download
memory/6108-355-0x0000000004F45000-0x0000000004F56000-memory.dmp

Filesize
68KB

Download