Overview

overview

10

Static

static

7afc896ff5...32.exe

windows7_x64

10

7afc896ff5...32.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01-07-2022 06:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe

  • Size

    189KB

  • MD5

    e5f8880417891a0d527b29cad8e087b0

  • SHA1

    9784587256aaeb4e6a68ba13d0848647928dfbb2

  • SHA256

    7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732

  • SHA512

    262a5ebff4525984d6d98f3831f142f3f695101d5067762ef4ceaca196bf0e5941ff0173b95a63c4355a49452e423805eb131ba53c711344619fa08d78510db6

Score
10/10
smokeloaderbackdoorpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://dogewareservice.ru/

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Checks computer location settings 2 TTPs 44 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 47 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
          PID:4628
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1216
            4⤵
            • Program crash
            PID:2632
      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          3⤵
          • Maps connected drives based on registry
          • Suspicious behavior: MapViewOfSection
          PID:1404
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
              PID:4656
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1184
                5⤵
                • Program crash
                PID:4900
          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
            3⤵
            • Checks computer location settings
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4424
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              4⤵
              • Maps connected drives based on registry
              • Suspicious behavior: MapViewOfSection
              PID:1336
              • C:\Windows\SysWOW64\explorer.exe
                explorer.exe
                5⤵
                  PID:344
              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                4⤵
                • Checks computer location settings
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1392
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                  5⤵
                  • Maps connected drives based on registry
                  • Suspicious behavior: MapViewOfSection
                  PID:3836
                  • C:\Windows\SysWOW64\explorer.exe
                    explorer.exe
                    6⤵
                      PID:3924
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 992
                        7⤵
                        • Program crash
                        PID:4976
                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                    5⤵
                    • Checks computer location settings
                    • Adds Run key to start application
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3344
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                      6⤵
                      • Maps connected drives based on registry
                      • Suspicious behavior: MapViewOfSection
                      PID:5112
                      • C:\Windows\SysWOW64\explorer.exe
                        explorer.exe
                        7⤵
                          PID:2528
                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                        6⤵
                        • Checks computer location settings
                        • Adds Run key to start application
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4516
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                          7⤵
                          • Maps connected drives based on registry
                          • Suspicious behavior: MapViewOfSection
                          PID:3844
                          • C:\Windows\SysWOW64\explorer.exe
                            explorer.exe
                            8⤵
                              PID:3720
                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                            7⤵
                            • Checks computer location settings
                            • Adds Run key to start application
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4280
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                              8⤵
                                PID:384
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                8⤵
                                • Maps connected drives based on registry
                                • Suspicious behavior: MapViewOfSection
                                PID:2500
                                • C:\Windows\SysWOW64\explorer.exe
                                  explorer.exe
                                  9⤵
                                    PID:716
                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                  8⤵
                                  • Checks computer location settings
                                  • Adds Run key to start application
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:1628
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                    9⤵
                                      PID:2604
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                      9⤵
                                      • Maps connected drives based on registry
                                      • Suspicious behavior: MapViewOfSection
                                      PID:2736
                                      • C:\Windows\SysWOW64\explorer.exe
                                        explorer.exe
                                        10⤵
                                          PID:1152
                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                        9⤵
                                        • Checks computer location settings
                                        • Adds Run key to start application
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1312
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                          10⤵
                                          • Maps connected drives based on registry
                                          • Suspicious behavior: MapViewOfSection
                                          PID:1204
                                          • C:\Windows\SysWOW64\explorer.exe
                                            explorer.exe
                                            11⤵
                                              PID:5004
                                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                            10⤵
                                            • Checks computer location settings
                                            • Adds Run key to start application
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2380
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                              11⤵
                                              • Maps connected drives based on registry
                                              • Suspicious behavior: MapViewOfSection
                                              PID:4792
                                              • C:\Windows\SysWOW64\explorer.exe
                                                explorer.exe
                                                12⤵
                                                  PID:3096
                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                11⤵
                                                • Checks computer location settings
                                                • Adds Run key to start application
                                                • Suspicious use of SetThreadContext
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4376
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                  12⤵
                                                    PID:1756
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                    12⤵
                                                    • Maps connected drives based on registry
                                                    • Suspicious behavior: MapViewOfSection
                                                    PID:4968
                                                    • C:\Windows\SysWOW64\explorer.exe
                                                      explorer.exe
                                                      13⤵
                                                        PID:796
                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                      12⤵
                                                      • Checks computer location settings
                                                      • Adds Run key to start application
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious behavior: MapViewOfSection
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2968
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                        13⤵
                                                          PID:3200
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                          13⤵
                                                          • Maps connected drives based on registry
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:3432
                                                          • C:\Windows\SysWOW64\explorer.exe
                                                            explorer.exe
                                                            14⤵
                                                              PID:5052
                                                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                            13⤵
                                                            • Checks computer location settings
                                                            • Adds Run key to start application
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious behavior: MapViewOfSection
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4132
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                              14⤵
                                                                PID:3496
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                14⤵
                                                                • Maps connected drives based on registry
                                                                • Suspicious behavior: MapViewOfSection
                                                                PID:4808
                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                  explorer.exe
                                                                  15⤵
                                                                    PID:60
                                                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                  14⤵
                                                                  • Checks computer location settings
                                                                  • Adds Run key to start application
                                                                  • Suspicious use of SetThreadContext
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:872
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                    15⤵
                                                                    • Maps connected drives based on registry
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:532
                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                      explorer.exe
                                                                      16⤵
                                                                        PID:4584
                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                      15⤵
                                                                      • Checks computer location settings
                                                                      • Adds Run key to start application
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4956
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                        16⤵
                                                                        • Maps connected drives based on registry
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:3592
                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                          explorer.exe
                                                                          17⤵
                                                                            PID:5084
                                                                        • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                          16⤵
                                                                          • Checks computer location settings
                                                                          • Adds Run key to start application
                                                                          • Suspicious use of SetThreadContext
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4840
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                            17⤵
                                                                            • Maps connected drives based on registry
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            PID:2148
                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                              explorer.exe
                                                                              18⤵
                                                                                PID:2604
                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                              17⤵
                                                                              • Checks computer location settings
                                                                              • Adds Run key to start application
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2412
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                18⤵
                                                                                • Maps connected drives based on registry
                                                                                PID:4740
                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                  explorer.exe
                                                                                  19⤵
                                                                                    PID:2104
                                                                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                  18⤵
                                                                                  • Checks computer location settings
                                                                                  • Adds Run key to start application
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4024
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                    19⤵
                                                                                    • Maps connected drives based on registry
                                                                                    PID:1716
                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                      explorer.exe
                                                                                      20⤵
                                                                                        PID:2944
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                      19⤵
                                                                                      • Checks computer location settings
                                                                                      • Adds Run key to start application
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3136
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                        20⤵
                                                                                        • Maps connected drives based on registry
                                                                                        PID:2068
                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                          explorer.exe
                                                                                          21⤵
                                                                                            PID:3408
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                          20⤵
                                                                                          • Checks computer location settings
                                                                                          • Adds Run key to start application
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4704
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                            21⤵
                                                                                            • Maps connected drives based on registry
                                                                                            PID:3776
                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                              explorer.exe
                                                                                              22⤵
                                                                                                PID:3196
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                              21⤵
                                                                                              • Checks computer location settings
                                                                                              • Adds Run key to start application
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2008
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                22⤵
                                                                                                • Maps connected drives based on registry
                                                                                                PID:1748
                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                  explorer.exe
                                                                                                  23⤵
                                                                                                    PID:1528
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                  22⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Adds Run key to start application
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4936
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                    23⤵
                                                                                                    • Maps connected drives based on registry
                                                                                                    PID:4124
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      explorer.exe
                                                                                                      24⤵
                                                                                                        PID:2248
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                      23⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Adds Run key to start application
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4164
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                        24⤵
                                                                                                        • Maps connected drives based on registry
                                                                                                        PID:3676
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          explorer.exe
                                                                                                          25⤵
                                                                                                            PID:5064
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1124
                                                                                                              26⤵
                                                                                                              • Program crash
                                                                                                              PID:2632
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                          24⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Adds Run key to start application
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4424
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                            25⤵
                                                                                                            • Maps connected drives based on registry
                                                                                                            PID:4576
                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                              explorer.exe
                                                                                                              26⤵
                                                                                                                PID:2220
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 1196
                                                                                                                  27⤵
                                                                                                                  • Program crash
                                                                                                                  PID:4032
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                              25⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Adds Run key to start application
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4512
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                26⤵
                                                                                                                  PID:2512
                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    27⤵
                                                                                                                      PID:2716
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                    26⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3128
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                      27⤵
                                                                                                                      • Maps connected drives based on registry
                                                                                                                      PID:1696
                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        28⤵
                                                                                                                          PID:4244
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1180
                                                                                                                            29⤵
                                                                                                                            • Program crash
                                                                                                                            PID:212
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                        27⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2596
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                          28⤵
                                                                                                                            PID:1720
                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              29⤵
                                                                                                                                PID:4376
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1172
                                                                                                                                  30⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:1464
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                              28⤵
                                                                                                                                PID:2100
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                28⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:3232
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                  29⤵
                                                                                                                                  • Maps connected drives based on registry
                                                                                                                                  PID:2268
                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    30⤵
                                                                                                                                      PID:1856
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                    29⤵
                                                                                                                                      PID:2376
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                        30⤵
                                                                                                                                        • Maps connected drives based on registry
                                                                                                                                        PID:1912
                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          31⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2260
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1180
                                                                                                                                            32⤵
                                                                                                                                            • Program crash
                                                                                                                                            PID:4664
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                        30⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3740
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                          31⤵
                                                                                                                                          • Maps connected drives based on registry
                                                                                                                                          PID:1016
                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            32⤵
                                                                                                                                              PID:4476
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                            31⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:2316
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                              32⤵
                                                                                                                                              • Maps connected drives based on registry
                                                                                                                                              PID:2764
                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                33⤵
                                                                                                                                                  PID:2520
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1196
                                                                                                                                                    34⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:900
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                32⤵
                                                                                                                                                  PID:2852
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                  32⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:4000
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                    33⤵
                                                                                                                                                    • Maps connected drives based on registry
                                                                                                                                                    PID:4804
                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      34⤵
                                                                                                                                                      • Maps connected drives based on registry
                                                                                                                                                      PID:2512
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                    33⤵
                                                                                                                                                      PID:2260
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                        34⤵
                                                                                                                                                        • Maps connected drives based on registry
                                                                                                                                                        PID:936
                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          35⤵
                                                                                                                                                            PID:3556
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 960
                                                                                                                                                              36⤵
                                                                                                                                                              • Program crash
                                                                                                                                                              PID:212
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                          34⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:4348
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                            35⤵
                                                                                                                                                            • Maps connected drives based on registry
                                                                                                                                                            PID:3300
                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              36⤵
                                                                                                                                                              • Maps connected drives based on registry
                                                                                                                                                              PID:1720
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 1188
                                                                                                                                                                37⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:4620
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                            35⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2736
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                              36⤵
                                                                                                                                                              • Maps connected drives based on registry
                                                                                                                                                              PID:3420
                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                explorer.exe
                                                                                                                                                                37⤵
                                                                                                                                                                  PID:2860
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                36⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:3764
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                  37⤵
                                                                                                                                                                    PID:332
                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      38⤵
                                                                                                                                                                        PID:4792
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                      37⤵
                                                                                                                                                                        PID:4800
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                        37⤵
                                                                                                                                                                          PID:3020
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                            38⤵
                                                                                                                                                                              PID:1824
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                              38⤵
                                                                                                                                                                                PID:1044
                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  39⤵
                                                                                                                                                                                    PID:3836
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1176
                                                                                                                                                                                      40⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:4964
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                  38⤵
                                                                                                                                                                                    PID:4784
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                    38⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:2376
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                      39⤵
                                                                                                                                                                                        PID:2016
                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          40⤵
                                                                                                                                                                                            PID:4516
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1124
                                                                                                                                                                                              41⤵
                                                                                                                                                                                              • Program crash
                                                                                                                                                                                              PID:4764
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                          39⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:4028
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                            40⤵
                                                                                                                                                                                              PID:4140
                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                41⤵
                                                                                                                                                                                                  PID:908
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                40⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:3524
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                  41⤵
                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      42⤵
                                                                                                                                                                                                        PID:1880
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                            43⤵
                                                                                                                                                                                                              PID:2816
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 1192
                                                                                                                                                                                                                44⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                PID:1448
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                PID:1840
                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                  43⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:1468
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                    44⤵
                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        45⤵
                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                        44⤵
                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                            45⤵
                                                                                                                                                                                                                              PID:2908
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                  PID:4928
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 1192
                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                    PID:2284
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                45⤵
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1188
                                                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                      46⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:3344
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                                                          PID:852
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                          47⤵
                                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                                                PID:2380
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                              47⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                48⤵
                                                                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                      PID:176
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                                                                          PID:1708
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                                                                              PID:1916
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 1176
                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:2160
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                                                                              PID:1596
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                  50⤵
                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                      51⤵
                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                                                                        PID:3592
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                                                                              PID:4828
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 972
                                                                                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                                                                                                          PID:3136
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                                                                              PID:4740
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                  PID:4132
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                53⤵
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                                                                        PID:1392
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1172
                                                                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                                                                                                        PID:332
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                                                                PID:3380
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                              55⤵
                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                                                                    PID:4032
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                                                                              PID:2364
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                                                                                                PID:3660
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                                                                    PID:1388
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                                                                        PID:2884
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                                                                PID:8
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2868
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2204
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                                                                                        PID:8
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1376
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3464
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1044
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                      62⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:216
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                          63⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                              63⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:976
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:332
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      68⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            69⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              74⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    75⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7afc896ff5590bde1e2533e40573e20b365c1f0ed261e8d7ca0e1fe01ef7f732.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4628 -ip 4628
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4656 -ip 4656
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3924 -ip 3924
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5064 -ip 5064
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2220 -ip 2220
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:1256
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4244 -ip 4244
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4376 -ip 4376
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4072
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2260 -ip 2260
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:4000
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2520 -ip 2520
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3556 -ip 3556
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1720 -ip 1720
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3836 -ip 3836
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4516 -ip 4516
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2908
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2816 -ip 2816
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4928 -ip 4928
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2416 -ip 2416
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1916 -ip 1916
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4784
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3872 -ip 3872
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1392 -ip 1392
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3588

                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                    Scripting

                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                    T1064

                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                    T1060

                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                    Scripting

                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                    T1064

                                                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                    • memory/60-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/344-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/344-212-0x0000000001090000-0x000000000109A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/344-211-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/532-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/532-193-0x0000000000DE0000-0x0000000000DEA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/716-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/716-228-0x0000000000BF0000-0x0000000000BFA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/716-233-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/796-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/872-191-0x0000000005570000-0x0000000005A9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/872-189-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1080-179-0x0000000000FB0000-0x0000000000FBA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1080-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1080-135-0x0000000000400000-0x0000000000405000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      20KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1080-138-0x0000000000FB0000-0x0000000000FBA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1080-136-0x0000000000FB0000-0x0000000000FBA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1152-238-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1152-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1188-137-0x0000000005540000-0x0000000005A6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1188-132-0x0000000005700000-0x0000000005792000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      584KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1188-130-0x0000000000C10000-0x0000000000C46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1188-131-0x0000000005A70000-0x0000000005F9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1188-133-0x0000000005540000-0x0000000005A6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1204-175-0x0000000000AA0000-0x0000000000AAA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1204-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1312-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1312-231-0x0000000004940000-0x0000000004E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1312-174-0x0000000004940000-0x0000000004E6C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1336-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1336-149-0x00000000009D0000-0x00000000009DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1392-155-0x0000000004B80000-0x00000000050AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1392-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1404-145-0x0000000000B10000-0x0000000000B1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1404-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1628-168-0x0000000005340000-0x000000000586C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1628-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1716-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1716-219-0x0000000001200000-0x000000000120A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/1748-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2008-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2008-245-0x0000000004880000-0x0000000004DAC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2032-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2032-144-0x0000000004EB0000-0x00000000053DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2068-227-0x00000000007E0000-0x00000000007EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2068-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2148-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2380-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2380-173-0x0000000004A70000-0x0000000004F9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2412-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2412-209-0x00000000052D0000-0x00000000057FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2500-164-0x0000000000120000-0x000000000012A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2500-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2512-270-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-216-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-217-0x0000000000A10000-0x0000000000A1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2528-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2736-169-0x0000000000440000-0x000000000044A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2736-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2968-182-0x0000000005180000-0x00000000056AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/2968-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3096-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3096-244-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3136-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3136-226-0x0000000005520000-0x0000000005A4C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3344-154-0x0000000004860000-0x0000000004D8C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3344-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3432-183-0x0000000000E50000-0x0000000000E5A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3432-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3592-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3592-197-0x0000000000790000-0x000000000079A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3676-256-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3720-223-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3720-225-0x0000000000EF0000-0x0000000000EFA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3720-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3776-235-0x0000000000990000-0x000000000099A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3776-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3836-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3836-156-0x0000000000260000-0x000000000026A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3844-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3844-163-0x0000000000250000-0x000000000025A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3924-208-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3924-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/3924-213-0x00000000012F0000-0x00000000012FA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4024-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4024-218-0x0000000005610000-0x0000000005B3C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4124-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4132-187-0x0000000005120000-0x000000000564C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4132-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4164-255-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4280-162-0x0000000005580000-0x0000000005AAC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4280-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4376-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4376-181-0x00000000053B0000-0x00000000053C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4424-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4424-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4424-148-0x00000000050F0000-0x000000000561C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4512-263-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4516-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4576-261-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4584-262-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4628-141-0x0000000000750000-0x000000000075A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4628-200-0x0000000000750000-0x000000000075A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4628-140-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4628-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4656-204-0x00000000001C0000-0x00000000001CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4656-203-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4656-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4704-234-0x0000000004BB0000-0x00000000050DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4704-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4740-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4792-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-188-0x0000000000A40000-0x0000000000A4A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4840-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4840-202-0x0000000005130000-0x000000000565C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4936-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4956-196-0x0000000004AE0000-0x000000000500C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4956-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4968-184-0x0000000000980000-0x000000000098A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/4968-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5004-239-0x0000000000180000-0x000000000018A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5004-243-0x0000000000210000-0x0000000000643000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      4.2MB

                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5004-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5052-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5084-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5112-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                      Download
                                                                                                                                                                                                                                                                                                                                                                    • memory/5112-157-0x00000000007B0000-0x00000000007BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                                                                                                      Download