Analysis

  • max time kernel
    152s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2022 15:32

General

  • Target

    3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9.exe

  • Size

    1.2MB

  • MD5

    7132076fe70278fbe2dda128cc366475

  • SHA1

    2f855ab609d76ad9a0e82b57e7989a9a1860dd77

  • SHA256

    3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9

  • SHA512

    162f6eec3460c6fdcb78be5f0ca4a54e29894c1afae606e7e8e6a73e42f4a84185648ebcda8ae0ba09ede694418a44513e099c20403df0a8cb1522e780413b51

  • SSDEEP

    24576:Dtb20pkACqT5TBWgNQ7ar+P2ZPGhv05szsKp6A:Arg5tQ7ar+TvBf5

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Creates scheduled task(s) 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9.exe
    "C:\Users\Admin\AppData\Local\Temp\3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4844
    • C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
      2⤵
        PID:4928
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
        2⤵
        • Creates scheduled task(s)
        PID:4780
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
        2⤵
          PID:1028
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
          2⤵
          • Creates scheduled task(s)
          PID:3456
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
          2⤵
            PID:2896
          • C:\Windows\SysWOW64\schtasks.exe
            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
            2⤵
            • Creates scheduled task(s)
            PID:3404
          • C:\Windows\SysWOW64\schtasks.exe
            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
            2⤵
              PID:4192
            • C:\Windows\SysWOW64\schtasks.exe
              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
              2⤵
              • Creates scheduled task(s)
              PID:3928
            • C:\Windows\SysWOW64\schtasks.exe
              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
              2⤵
                PID:3564
              • C:\Windows\SysWOW64\schtasks.exe
                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                2⤵
                  PID:4232
                • C:\Windows\SysWOW64\schtasks.exe
                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                  2⤵
                    PID:636
                  • C:\Windows\SysWOW64\schtasks.exe
                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                    2⤵
                      PID:4848
                    • C:\Windows\SysWOW64\schtasks.exe
                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                      2⤵
                        PID:1664
                      • C:\Windows\SysWOW64\schtasks.exe
                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                        2⤵
                          PID:3212
                        • C:\Windows\SysWOW64\schtasks.exe
                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                          2⤵
                            PID:1008
                          • C:\Windows\SysWOW64\schtasks.exe
                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                            2⤵
                              PID:1564
                            • C:\Windows\SysWOW64\schtasks.exe
                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                              2⤵
                              • Creates scheduled task(s)
                              PID:3628
                            • C:\Windows\SysWOW64\schtasks.exe
                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                              2⤵
                                PID:1996
                              • C:\Windows\SysWOW64\schtasks.exe
                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                2⤵
                                  PID:4260
                                • C:\Windows\SysWOW64\schtasks.exe
                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                  2⤵
                                    PID:8
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                    2⤵
                                    • Creates scheduled task(s)
                                    PID:3640
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                    2⤵
                                      PID:3088
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                      2⤵
                                        PID:4408
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                        2⤵
                                          PID:3964
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                          2⤵
                                          • Creates scheduled task(s)
                                          PID:4936
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                          2⤵
                                            PID:3604
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                            2⤵
                                            • Creates scheduled task(s)
                                            PID:4552
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                            2⤵
                                              PID:756
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                              2⤵
                                                PID:1900
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                2⤵
                                                  PID:4980
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                  2⤵
                                                    PID:3892
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                    2⤵
                                                      PID:3584
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                      2⤵
                                                      • Creates scheduled task(s)
                                                      PID:2468
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                      2⤵
                                                        PID:944
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                        2⤵
                                                          PID:3736
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                          2⤵
                                                            PID:1124
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                            2⤵
                                                              PID:2080
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                              2⤵
                                                                PID:3476
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                2⤵
                                                                  PID:3264
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                  2⤵
                                                                    PID:2116
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                    2⤵
                                                                      PID:3404
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                      2⤵
                                                                        PID:4344
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                        2⤵
                                                                          PID:920
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                          2⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:1704
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                          2⤵
                                                                            PID:1668
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                            2⤵
                                                                              PID:2672
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                              2⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:1416
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                              2⤵
                                                                                PID:4672
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                2⤵
                                                                                • Creates scheduled task(s)
                                                                                PID:1896
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                2⤵
                                                                                  PID:2488
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                  2⤵
                                                                                  • Creates scheduled task(s)
                                                                                  PID:1552
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                  2⤵
                                                                                  • Creates scheduled task(s)
                                                                                  PID:3628
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                  2⤵
                                                                                    PID:2540
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                    2⤵
                                                                                      PID:932
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                      2⤵
                                                                                        PID:2868
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                        2⤵
                                                                                        • Creates scheduled task(s)
                                                                                        PID:2236
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                        2⤵
                                                                                        • Creates scheduled task(s)
                                                                                        PID:4924
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                        2⤵
                                                                                          PID:3936
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                          2⤵
                                                                                            PID:3392
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                            2⤵
                                                                                              PID:1288
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                              2⤵
                                                                                                PID:3436
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                2⤵
                                                                                                  PID:2520
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                  2⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:648
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                  2⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:1028
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                  2⤵
                                                                                                    PID:1252
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                    2⤵
                                                                                                      PID:4160
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                      2⤵
                                                                                                      • Creates scheduled task(s)
                                                                                                      PID:4904
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                      2⤵
                                                                                                        PID:4868
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                        2⤵
                                                                                                          PID:4644
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                          2⤵
                                                                                                            PID:956
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:2320
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                            2⤵
                                                                                                              PID:3368
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                              2⤵
                                                                                                              • Creates scheduled task(s)
                                                                                                              PID:3644
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                              2⤵
                                                                                                                PID:4756
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                2⤵
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:4136
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                2⤵
                                                                                                                  PID:2548
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                  2⤵
                                                                                                                  • Creates scheduled task(s)
                                                                                                                  PID:3632
                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                  2⤵
                                                                                                                    PID:1476
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                    2⤵
                                                                                                                      PID:2728
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                      2⤵
                                                                                                                      • Creates scheduled task(s)
                                                                                                                      PID:4204
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                      2⤵
                                                                                                                        PID:1144
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                        2⤵
                                                                                                                          PID:728
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                          2⤵
                                                                                                                            PID:2284
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                            2⤵
                                                                                                                              PID:2128
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:3264
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                              2⤵
                                                                                                                                PID:1532
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                2⤵
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:4992
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                2⤵
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:2860
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                2⤵
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:3812
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                2⤵
                                                                                                                                  PID:2416
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3268
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:756
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                  2⤵
                                                                                                                                    PID:1808
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                    2⤵
                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                    PID:4160
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                    2⤵
                                                                                                                                      PID:3668
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4416
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                      2⤵
                                                                                                                                        PID:3088
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                        2⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:1424
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                        2⤵
                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                        PID:3056
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                        2⤵
                                                                                                                                          PID:4396
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                          2⤵
                                                                                                                                            PID:4876
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                            2⤵
                                                                                                                                              PID:4080
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                              2⤵
                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                              PID:4516
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                              2⤵
                                                                                                                                                PID:3148
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                2⤵
                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                PID:4960
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                2⤵
                                                                                                                                                  PID:1140
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:1904
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3424
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1412
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1172
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:1636
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                        2⤵
                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                        PID:1836
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4912
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5144
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                            2⤵
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:5200
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                            2⤵
                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                            PID:5256
                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5312
                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5412
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5480
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5548
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5620
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5700
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:5776
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                        PID:5840
                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5900
                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5952
                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6016
                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6076
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                PID:6132
                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5332
                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                  PID:5500
                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:784
                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2556
                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2632
                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4952
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1668
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2520
                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3300
                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3476
                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3468
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3456
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:5872
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                  PID:3148
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3016
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                      PID:5548
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4472
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5348
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:448
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5260
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1892
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:4528
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2192
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                PID:3408
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:5976
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:688
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1984
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1668
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                          PID:3916
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5684
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:5132
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:2260
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:5688
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                      PID:1316
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3052
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:5292
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                            PID:1404
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3260
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:780
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:5880
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:636
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2936
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:5984
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:3404
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:5740
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:3016
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:5516
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:5624
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                          PID:6040
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                          PID:1212
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                              PID:5424
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:5448
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr112.exe" /tr "C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe" /f
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                PID:5380

                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe

                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                7132076fe70278fbe2dda128cc366475

                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                2f855ab609d76ad9a0e82b57e7989a9a1860dd77

                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9

                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                162f6eec3460c6fdcb78be5f0ca4a54e29894c1afae606e7e8e6a73e42f4a84185648ebcda8ae0ba09ede694418a44513e099c20403df0a8cb1522e780413b51

                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe

                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                7132076fe70278fbe2dda128cc366475

                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                2f855ab609d76ad9a0e82b57e7989a9a1860dd77

                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9

                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                162f6eec3460c6fdcb78be5f0ca4a54e29894c1afae606e7e8e6a73e42f4a84185648ebcda8ae0ba09ede694418a44513e099c20403df0a8cb1522e780413b51

                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Windows\winmgr112.exe

                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                7132076fe70278fbe2dda128cc366475

                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                2f855ab609d76ad9a0e82b57e7989a9a1860dd77

                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                3595580527a7739a0a96f70bd805d1e89b77c6bfd239a17b6e63ba604885dfe9

                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                162f6eec3460c6fdcb78be5f0ca4a54e29894c1afae606e7e8e6a73e42f4a84185648ebcda8ae0ba09ede694418a44513e099c20403df0a8cb1522e780413b51

                                                                                                                                                                                                                                                                                                                              • memory/8-155-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/636-145-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/648-200-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/756-163-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/920-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/932-191-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/944-171-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1008-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1028-137-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1124-173-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1288-197-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1416-184-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1552-188-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1564-150-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1664-147-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1668-182-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1704-181-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1896-186-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1900-166-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/1996-152-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2080-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2116-177-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2236-193-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2468-170-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2488-187-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2520-199-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2540-190-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2672-183-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2868-192-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/2896-139-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3088-157-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3212-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3264-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3392-196-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3404-178-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3404-140-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3436-198-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3456-138-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3476-175-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3564-143-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3584-169-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3604-161-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3628-151-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3628-189-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3640-156-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3736-172-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3892-168-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3928-142-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3936-195-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/3964-159-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4192-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4232-144-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4260-154-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4344-179-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4408-158-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4552-162-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4672-185-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4780-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4844-153-0x0000000072FF0000-0x00000000735A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                5.7MB

                                                                                                                                                                                                                                                                                                                              • memory/4844-136-0x0000000072FF0000-0x00000000735A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                5.7MB

                                                                                                                                                                                                                                                                                                                              • memory/4844-132-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4844-133-0x0000000000400000-0x000000000044A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                296KB

                                                                                                                                                                                                                                                                                                                              • memory/4848-146-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4924-194-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4928-134-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4936-160-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                              • memory/4980-167-0x0000000000000000-mapping.dmp