Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2024, 18:04

General

  • Target

    60759f43f640fb1caf0baf142fd8be9a_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    60759f43f640fb1caf0baf142fd8be9a

  • SHA1

    0ed38c5a57c695353eae28fd407eba92c95dc074

  • SHA256

    23c48717d3d09e0ed3c5903bb7fcccc81402f7b78b7f19fffa53e497e466a8b8

  • SHA512

    703e436e6d0a9bed455c1e78855f937ad99ebaf6a53b63a32890165ef61ac2ca22a233113b2db911bf672bf27da08bf5f75f7424dcd96660a5cd029203af45ab

  • SSDEEP

    24576:prMMGKDlavjUEQElhcjUuS+kQ0LaSA8o19MNMeE5GKSL1hCGjOFCYzfCADRXriJG:prMMZlavoRkQb8CuMebPbNYR2iuKP

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60759f43f640fb1caf0baf142fd8be9a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\60759f43f640fb1caf0baf142fd8be9a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\RtHelp.exe
      "C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\RtHelp.exe" --InstSupp --Supp 602 --Ver 180
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3212
    • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\RtHelp.exe
      "C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\RtHelp.exe" --PreCheck 602 --Uid 1AAB01C52D87254097E18F12E3C93654 --Ver 180
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Maps connected drives based on registry
      PID:4560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 900
      2⤵
      • Program crash
      PID:3240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 912
      2⤵
      • Program crash
      PID:1732
    • C:\Users\Admin\AppData\Local\Temp\nsu66F0.tmp
      "C:\Users\Admin\AppData\Local\Temp\nsu66F0.tmp" /S _?=C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73
      2⤵
        PID:2348
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 608
          3⤵
          • Program crash
          PID:3348
        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
          "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --Uninstall
          3⤵
            PID:3660
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2776 -ip 2776
        1⤵
          PID:4224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2776 -ip 2776
          1⤵
            PID:3384
          • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
            C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2464
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2024
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4148
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5024
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1332
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3912
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3080
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1020
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2664
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1328
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4260
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3492
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:116
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3068
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1036
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1052
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2336
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4936
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3548
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3244
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:628
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2672
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3964
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3856
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2244
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2544
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2348
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:940
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:636
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1972
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3516
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4776
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3660
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1732
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3068
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2204
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4500
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2404
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3704
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2168
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4556
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2620
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1240
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1864
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1436
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4180
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:2380
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1352
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4808
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3288
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:1004
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4648
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4348
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4356
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4048
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4444
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3700
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4440
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:5008
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:224
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:3736
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
              • Executes dropped EXE
              PID:4580
            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
              2⤵
                PID:4216
              • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                2⤵
                  PID:3092
                • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                  "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                  2⤵
                    PID:3260
                  • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                    "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                    2⤵
                      PID:2624
                    • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                      "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                      2⤵
                        PID:2708
                      • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                        "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                        2⤵
                          PID:3332
                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                          "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                          2⤵
                            PID:5052
                          • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                            "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                            2⤵
                              PID:4324
                            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                              2⤵
                                PID:1192
                              • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                2⤵
                                  PID:2420
                                • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                  "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                  2⤵
                                    PID:2368
                                  • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                    "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                    2⤵
                                      PID:3292
                                    • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                      "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                      2⤵
                                        PID:3180
                                      • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                        "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                        2⤵
                                          PID:1168
                                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                          "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                          2⤵
                                            PID:468
                                          • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                            "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                            2⤵
                                              PID:4040
                                            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                              2⤵
                                                PID:1640
                                              • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                2⤵
                                                  PID:1948
                                                • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                  "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                  2⤵
                                                    PID:4924
                                                  • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                    "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                    2⤵
                                                      PID:4544
                                                    • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                      "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                      2⤵
                                                        PID:4028
                                                      • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                        "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                        2⤵
                                                          PID:2140
                                                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                          "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                          2⤵
                                                            PID:3244
                                                          • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                            "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                            2⤵
                                                              PID:628
                                                            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                              2⤵
                                                                PID:3260
                                                              • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                2⤵
                                                                  PID:3476
                                                                • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                  "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                  2⤵
                                                                    PID:2708
                                                                  • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                    "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                    2⤵
                                                                      PID:3332
                                                                    • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                      "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                      2⤵
                                                                        PID:1428
                                                                      • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                        "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                        2⤵
                                                                          PID:1816
                                                                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                          "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                          2⤵
                                                                            PID:2080
                                                                          • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                            "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                            2⤵
                                                                              PID:556
                                                                            • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                              "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                              2⤵
                                                                                PID:1624
                                                                              • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                                "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                                2⤵
                                                                                  PID:4560
                                                                                • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                                  "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                                  2⤵
                                                                                    PID:3512
                                                                                  • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                                    "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                                    2⤵
                                                                                      PID:1740
                                                                                    • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                                      "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                                      2⤵
                                                                                        PID:4988
                                                                                      • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe
                                                                                        "C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ARQB4AHAAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEUANABCADYANgBEAEQANAAtADMAMgA3AEYALQA0ADQANAAzAC0AQgBCAEIAQQAtAEQANAAzADYANQA4ADgAMAAwAEYANwAzAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==
                                                                                        2⤵
                                                                                          PID:3208
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2348 -ip 2348
                                                                                        1⤵
                                                                                          PID:1556

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Modules\cdp.dll

                                                                                          Filesize

                                                                                          91KB

                                                                                          MD5

                                                                                          2f369f9928242f730d3cf48678158111

                                                                                          SHA1

                                                                                          f31361fb3ed6f6654ad921cdc59786df4c10885a

                                                                                          SHA256

                                                                                          a056ad6496931b0c0a9405cf4f7a34db68c3b78b30d4907f9472994b836ea022

                                                                                          SHA512

                                                                                          c22c479183f66b65e1cf5b7ed75e30f18db5fd7f6427c04385990d181c53216df33994f296ed235357cc0f22e4d437e97983f910ec67fc7e52fe48fafbbebabe

                                                                                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Modules\nvs.dll

                                                                                          Filesize

                                                                                          90KB

                                                                                          MD5

                                                                                          ce70e808b2bcdf50f9fec5a965503af8

                                                                                          SHA1

                                                                                          d8168523669f119d3e603f9569078e36362680f4

                                                                                          SHA256

                                                                                          3a35ed22fe448967d3bbb5ac16710f755760f2a083f05b22884abe811d688039

                                                                                          SHA512

                                                                                          2449dc3716362a1a572fbf7f9472ec0d975dca07cd6d4a7cf50c72c62f9ace9a6d9f7f7f3702dcf32a8bbe81b3f38c3248ac98709d3b4f26d329a6f0f7fb770c

                                                                                        • C:\Users\Admin\AppData\Local\E4B66DD4-327F-4443-BBBA-D43658800F73\Update\ExtPkg0

                                                                                          Filesize

                                                                                          122B

                                                                                          MD5

                                                                                          63bfc22e886a88b4a7ad8bb9f6ae7cb4

                                                                                          SHA1

                                                                                          fb11f297b81cd271d92a7d9636b2359691709709

                                                                                          SHA256

                                                                                          782ac03b708653aec3db845a028fcb89f68ebfc3242bf6402116d9749ad86a0d

                                                                                          SHA512

                                                                                          47d73ca7e0d36a00e00f7d311abe57b38803d5f30522d75d7a369fdf802c2f893aaa47d3795e8681d91d0b6b914725f709681de4ac810acd1a1923a36e9da6d9

                                                                                        • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\MSVCP110.dll

                                                                                          Filesize

                                                                                          522KB

                                                                                          MD5

                                                                                          3e29914113ec4b968ba5eb1f6d194a0a

                                                                                          SHA1

                                                                                          557b67e372e85eb39989cb53cffd3ef1adabb9fe

                                                                                          SHA256

                                                                                          c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a

                                                                                          SHA512

                                                                                          75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43

                                                                                        • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\MSVCR110.dll

                                                                                          Filesize

                                                                                          854KB

                                                                                          MD5

                                                                                          4ba25d2cbe1587a841dcfb8c8c4a6ea6

                                                                                          SHA1

                                                                                          52693d4b5e0b55a929099b680348c3932f2c3c62

                                                                                          SHA256

                                                                                          b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49

                                                                                          SHA512

                                                                                          82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6

                                                                                        • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\Modules\clc.dll

                                                                                          Filesize

                                                                                          111KB

                                                                                          MD5

                                                                                          68ec32cf0860c9db2f668964a928c913

                                                                                          SHA1

                                                                                          3949cd9177b93bc4ad76fdaf8bc2eb2252802972

                                                                                          SHA256

                                                                                          f1107b54b4cbbfbd7a894226317918f5aadafd56c65ea255c81facdc539b88be

                                                                                          SHA512

                                                                                          267bf7498638c7a062e617b44b0eed61df441ea3ea4efb7cded47c062d903d084594797be5a9ccc783a5fd50f84799a2f33afda03cfff731b0e7c215b649f18e

                                                                                        • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\Modules\crm.dll

                                                                                          Filesize

                                                                                          104KB

                                                                                          MD5

                                                                                          d925422843f1e14f6504456764219367

                                                                                          SHA1

                                                                                          493c1992685c7413a9497aab830175ba92b1f80e

                                                                                          SHA256

                                                                                          ec27c6987d403bb31df794b47060fe707bca85c058ecb62b8a6ec9ab35de2c06

                                                                                          SHA512

                                                                                          9a510d68428c05f63cad243ba43a954fd595f57e2e88dddd0bf79094d19fb80ef9a71803cf635160bc88f4632176c330dadfef04681cff24fdba67732d1f9a06

                                                                                        • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\Modules\wis.dll

                                                                                          Filesize

                                                                                          42KB

                                                                                          MD5

                                                                                          875b93e5075b75fba8b080c578e9170c

                                                                                          SHA1

                                                                                          3e04baed759bafcf80a3edc7f16054739ceb1972

                                                                                          SHA256

                                                                                          3a942e2bfd313ecdbd48ebe05653b50d904f9b1dc30c86067446885a8d01dff7

                                                                                          SHA512

                                                                                          54c008a278de9fe898cc661393df22b62be9dddd31ab910e311a52ab7035b93949baeba7ff4fc40371061bdc6d9ac9ebc6dc5cd6e31050b44964e172162f6b89

                                                                                        • C:\Users\Admin\AppData\Local\Temp\B64CC0B8-D2BF-5248-BA11-62591F74E6B6\RtHelp.exe

                                                                                          Filesize

                                                                                          334KB

                                                                                          MD5

                                                                                          cdda1f88ec6c73e0f71a4549121165f9

                                                                                          SHA1

                                                                                          b4736704971dd67d904d3664772c815888d60d03

                                                                                          SHA256

                                                                                          0946e5e56039b750820fad2169e66ffe31a5a0d93fc17734948c40f9ef147c43

                                                                                          SHA512

                                                                                          e72c718fe4f0786d171ebc2daf1402667cf380e88877b5675ac782ec22e1b643a4b19b39e193c9002674f2ced61d22de0a7a4f8db9a621fe61534be28fc28775

                                                                                        • C:\Users\Admin\AppData\Local\Temp\nso758F.tmp\System.dll

                                                                                          Filesize

                                                                                          11KB

                                                                                          MD5

                                                                                          3e6bf00b3ac976122f982ae2aadb1c51

                                                                                          SHA1

                                                                                          caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

                                                                                          SHA256

                                                                                          4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

                                                                                          SHA512

                                                                                          1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

                                                                                        • C:\Users\Admin\AppData\Local\Temp\nso758F.tmp\UpdHelper.dll

                                                                                          Filesize

                                                                                          130KB

                                                                                          MD5

                                                                                          bb40f596eab5c6598d320677b1731d62

                                                                                          SHA1

                                                                                          2c3f547355e07ba6585d955237a35e1125173028

                                                                                          SHA256

                                                                                          8b972cd7532648027a533330481a6fed08f70718b31396ddf6579519e862b169

                                                                                          SHA512

                                                                                          a2b6757d82bc9ad02516ab83b31c81c310cefc04ffe8ba1937febe44da2e9786a093fba21f6ed412403acde404a6684f7c2ad7f7696c03379fde9d3aee19b436

                                                                                        • C:\Users\Admin\AppData\Local\Temp\nso758F.tmp\md5dll.dll

                                                                                          Filesize

                                                                                          6KB

                                                                                          MD5

                                                                                          7059f133ea2316b9e7e39094a52a8c34

                                                                                          SHA1

                                                                                          ee9f1487c8152d8c42fecf2efb8ed1db68395802

                                                                                          SHA256

                                                                                          32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f

                                                                                          SHA512

                                                                                          9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51

                                                                                        • memory/2776-115-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-82-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-70-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-68-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-49-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-47-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-116-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-42-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-117-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-118-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-170-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-90-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-187-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-190-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-189-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB

                                                                                        • memory/2776-188-0x0000000002800000-0x000000000280A000-memory.dmp

                                                                                          Filesize

                                                                                          40KB