Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e0f8b0df16...18.exe

windows7-x64

10

e0f8b0df16...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 20:28 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e0f8b0df1697e5844b650bba0ead7720_JaffaCakes118.exe

  • Size

    672KB

  • MD5

    e0f8b0df1697e5844b650bba0ead7720

  • SHA1

    c01a13f86d413f9b88ab63672a8af8ea8eeee774

  • SHA256

    cfcbfff3fa38b1f0729d5300672755bfcc830343a7d11fad67516b2464355764

  • SHA512

    c84895e581cd635992385ebbda38e96dbceedc84b511cd75d5f508f68dd4b23cdefb2681cd1e122076fa766bc41cc639d8614f216ad5518a2d68308e6e84b201

  • SSDEEP

    12288:Nban5laK2O8+c+iPjuGJ/eEKbHa1aNv4VhW3LbkO7i/x2zsrW2qserjs9r1:daQOc+iPKMGbHa1aNwvokOmp2QrtqNjq

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 63 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0f8b0df1697e5844b650bba0ead7720_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e0f8b0df1697e5844b650bba0ead7720_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\server.exe
      "C:\Windows\server.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Impair Defenses: Safe Mode Boot
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Windows\SysWOW64\vssms32.exe
        "C:\Windows\system32\vssms32.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\vssms32.exe
          "C:\Windows\system32\vssms32.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4920
          • C:\Windows\SysWOW64\vssms32.exe
            "C:\Windows\system32\vssms32.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3112
            • C:\Windows\SysWOW64\vssms32.exe
              "C:\Windows\system32\vssms32.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2524
              • C:\Windows\SysWOW64\vssms32.exe
                "C:\Windows\system32\vssms32.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1832
                • C:\Windows\SysWOW64\vssms32.exe
                  "C:\Windows\system32\vssms32.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:64
                  • C:\Windows\SysWOW64\vssms32.exe
                    "C:\Windows\system32\vssms32.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:1164
                    • C:\Windows\SysWOW64\vssms32.exe
                      "C:\Windows\system32\vssms32.exe"
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4872
                      • C:\Windows\SysWOW64\vssms32.exe
                        "C:\Windows\system32\vssms32.exe"
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4280
                        • C:\Windows\SysWOW64\vssms32.exe
                          "C:\Windows\system32\vssms32.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:2040
                          • C:\Windows\SysWOW64\vssms32.exe
                            "C:\Windows\system32\vssms32.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3160
                            • C:\Windows\SysWOW64\vssms32.exe
                              "C:\Windows\system32\vssms32.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:344
                              • C:\Windows\SysWOW64\vssms32.exe
                                "C:\Windows\system32\vssms32.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:4512
                                • C:\Windows\SysWOW64\vssms32.exe
                                  "C:\Windows\system32\vssms32.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:2268
                                  • C:\Windows\SysWOW64\vssms32.exe
                                    "C:\Windows\system32\vssms32.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:936
                                    • C:\Windows\SysWOW64\vssms32.exe
                                      "C:\Windows\system32\vssms32.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:5096
                                      • C:\Windows\SysWOW64\vssms32.exe
                                        "C:\Windows\system32\vssms32.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of WriteProcessMemory
                                        PID:3936
                                        • C:\Windows\SysWOW64\vssms32.exe
                                          "C:\Windows\system32\vssms32.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1248
                                          • C:\Windows\SysWOW64\vssms32.exe
                                            "C:\Windows\system32\vssms32.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:3064
                                            • C:\Windows\SysWOW64\vssms32.exe
                                              "C:\Windows\system32\vssms32.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              PID:3956
                                              • C:\Windows\SysWOW64\vssms32.exe
                                                "C:\Windows\system32\vssms32.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                PID:3784
                                                • C:\Windows\SysWOW64\vssms32.exe
                                                  "C:\Windows\system32\vssms32.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:4080
                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                    "C:\Windows\system32\vssms32.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Modifies registry class
                                                    PID:1212
                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                      "C:\Windows\system32\vssms32.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:3276
                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                        "C:\Windows\system32\vssms32.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Modifies registry class
                                                        PID:4564
                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                          "C:\Windows\system32\vssms32.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          PID:4352
                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                            "C:\Windows\system32\vssms32.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            PID:4496
                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                              "C:\Windows\system32\vssms32.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Adds Run key to start application
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2912
                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                "C:\Windows\system32\vssms32.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                PID:4656
                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                  "C:\Windows\system32\vssms32.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  PID:4568
                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                    "C:\Windows\system32\vssms32.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4732
                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                      "C:\Windows\system32\vssms32.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Drops file in System32 directory
                                                                      • Modifies registry class
                                                                      PID:936
                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                        "C:\Windows\system32\vssms32.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        PID:5096
                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                          "C:\Windows\system32\vssms32.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          PID:5104
                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                            "C:\Windows\system32\vssms32.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1168
                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                              "C:\Windows\system32\vssms32.exe"
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:3652
                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1832
                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  PID:2612
                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4828
                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      PID:1368
                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                        43⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4860
                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          PID:3748
                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2792
                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              PID:3264
                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                PID:1084
                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies registry class
                                                                                                  PID:2460
                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Drops file in System32 directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3260
                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Adds Run key to start application
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry class
                                                                                                      PID:3064
                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3432
                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          • Modifies registry class
                                                                                                          PID:1308
                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                            53⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Adds Run key to start application
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies registry class
                                                                                                            PID:532
                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4840
                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Modifies registry class
                                                                                                                PID:4344
                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                  56⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Adds Run key to start application
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Modifies registry class
                                                                                                                  PID:4824
                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry class
                                                                                                                    PID:4860
                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      PID:3080
                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Drops file in System32 directory
                                                                                                                        PID:232
                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                          60⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Modifies registry class
                                                                                                                          PID:1348
                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:436
                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                              62⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Modifies registry class
                                                                                                                              PID:5104
                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Adds Run key to start application
                                                                                                                                PID:4148
                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3112
                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:400
                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:4416
                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:4256
                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                          68⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:532
                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:4280
                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                              70⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4360
                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                71⤵
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                PID:4328
                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                  72⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:2012
                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                    73⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:4776
                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                      74⤵
                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                      PID:4832
                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                        75⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:4576
                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                          76⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:4936
                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                            77⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3264
                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                              78⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:936
                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                79⤵
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4604
                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                  80⤵
                                                                                                                                                                    PID:512
                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3944
                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:3752
                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          PID:400
                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                            84⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4416
                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              PID:3912
                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                86⤵
                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:532
                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                  87⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  PID:4828
                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                    88⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1480
                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                      89⤵
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:4864
                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                        90⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3676
                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                          91⤵
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:1412
                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                            92⤵
                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            PID:1036
                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                              93⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              PID:2268
                                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                94⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                PID:3308
                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4016
                                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    PID:3832
                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2684
                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                          PID:1400
                                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:2632
                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:4256
                                                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                PID:672
                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:4064
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            PID:4576
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:4616
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4520
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1664
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:1856
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3236
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                              PID:4988
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:1944
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                    PID:1552
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        PID:3704
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            PID:3804
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:3224
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                PID:1832
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:2832
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        PID:3404
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                            PID:448
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                PID:3236
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                    PID:3884
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                PID:2584
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                    PID:408
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3944
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3104
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1212
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:392
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2952
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1748
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:532
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2600
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\vssms32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\vssms32.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1216
                                                                          • C:\Windows\kill.exe
                                                                            "C:\Windows\kill.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:3248
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4248,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
                                                                          1⤵
                                                                            PID:3448

                                                                          Network

                                                                          • flag-us
                                                                            DNS
                                                                            8.8.8.8.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            8.8.8.8.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            8.8.8.8.in-addr.arpa
                                                                            IN PTR
                                                                            dnsgoogle
                                                                          • flag-us
                                                                            DNS
                                                                            154.239.44.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            154.239.44.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            37.56.20.217.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            37.56.20.217.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            22.160.190.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            22.160.190.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            95.221.229.192.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            95.221.229.192.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            95.221.229.192.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            95.221.229.192.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            241.150.49.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            241.150.49.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            86.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            86.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            56.126.166.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            56.126.166.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            172.210.232.199.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            172.210.232.199.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            11.227.111.52.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            11.227.111.52.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            11.227.111.52.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            11.227.111.52.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            240.143.123.92.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            240.143.123.92.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            240.143.123.92.in-addr.arpa
                                                                            IN PTR
                                                                            a92-123-143-240deploystaticakamaitechnologiescom
                                                                          • 127.0.0.1:135
                                                                            server.exe
                                                                          • 127.0.0.1:49669
                                                                            server.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 127.0.0.1:135
                                                                            vssms32.exe
                                                                          • 127.0.0.1:49669
                                                                            vssms32.exe
                                                                          • 8.8.8.8:53
                                                                            8.8.8.8.in-addr.arpa
                                                                            dns
                                                                            66 B
                                                                             90 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            8.8.8.8.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            154.239.44.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            154.239.44.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            37.56.20.217.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             131 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            37.56.20.217.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            22.160.190.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            22.160.190.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            95.221.229.192.in-addr.arpa
                                                                            dns
                                                                            146 B
                                                                             144 B
                                                                             2
                                                                            1

                                                                            DNS Request

                                                                            95.221.229.192.in-addr.arpa

                                                                            DNS Request

                                                                            95.221.229.192.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            241.150.49.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            241.150.49.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            86.23.85.13.in-addr.arpa
                                                                            dns
                                                                            70 B
                                                                             144 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            86.23.85.13.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            56.126.166.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            56.126.166.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            172.210.232.199.in-addr.arpa
                                                                            dns
                                                                            74 B
                                                                             128 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            172.210.232.199.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            11.227.111.52.in-addr.arpa
                                                                            dns
                                                                            144 B
                                                                             158 B
                                                                             2
                                                                            1

                                                                            DNS Request

                                                                            11.227.111.52.in-addr.arpa

                                                                            DNS Request

                                                                            11.227.111.52.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            240.143.123.92.in-addr.arpa
                                                                            dns
                                                                            73 B
                                                                             139 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            240.143.123.92.in-addr.arpa

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Windows\kill.exe
                                                                            Filesize

                                                                            182KB

                                                                            MD5

                                                                            663604b29d5bd47d8fd7e34843438bcf

                                                                            SHA1

                                                                            6900b29ddb35d207e1948880f21f6ef488f52ef5

                                                                            SHA256

                                                                            15c968cb99c6b9446616b73580233ea588e9177a86c7447ccbe5c2f49a9e457d

                                                                            SHA512

                                                                            b7efbde4e9ca4e54f482d502687cd6ed09c9b942091a5fdc657bde8f1b9add3eb9b421c38be3ebe1382be4f73869d9b6a255a27649fe2c76d97084c6d52c6527

                                                                            Download Submit

                                                                          • C:\Windows\server.exe
                                                                            Filesize

                                                                            738KB

                                                                            MD5

                                                                            7f98d4e8a5c6410662d6f1219a867d4e

                                                                            SHA1

                                                                            fbcab3e6acff3344634d427dff81ed0d6eb7087c

                                                                            SHA256

                                                                            646d232885313bb69fed1026b0b57ec4c758f0edbba9baf4d181851713123617

                                                                            SHA512

                                                                            1635992d3d488088db410e218aa9fbe991ab2d03b7010d86b3721602b7c0e07f701dc27635e911a22ad5eaaf5e4c85d3559bc86be3de1045f98b11bd1507b2b0

                                                                            Download Submit

                                                                          • memory/64-72-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/232-156-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/344-85-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/436-158-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/532-150-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/936-129-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/936-92-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1084-143-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1164-74-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1168-133-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1212-109-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1248-98-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1308-149-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1348-157-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1368-138-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1832-70-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/1832-135-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2040-81-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2268-90-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2460-144-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2524-68-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2612-136-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2792-141-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2876-62-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/2912-121-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3064-100-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3064-147-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3080-155-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3112-66-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3160-83-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3248-110-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                            Download

                                                                          • memory/3248-17-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                            Download

                                                                          • memory/3248-79-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                            Download

                                                                          • memory/3248-88-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                            Download

                                                                          • memory/3248-24-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                            Download

                                                                          • memory/3248-132-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                            Download

                                                                          • memory/3248-20-0x000000000046E000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3260-146-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3264-142-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3276-112-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3432-148-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3652-134-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3748-140-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3784-104-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3936-96-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/3956-102-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4080-106-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4188-60-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4188-21-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4280-78-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4344-152-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4352-116-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4496-119-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4512-87-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4564-114-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4568-126-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4656-123-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4732-128-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4824-153-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4828-137-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4840-151-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4860-154-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4860-139-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4872-76-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/4920-64-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/5096-130-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/5096-94-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/5104-131-0x0000000000400000-0x00000000004BF000-memory.dmp

                                                                            Filesize

                                                                            764KB

                                                                            Download

                                                                          • memory/5116-23-0x0000000002940000-0x0000000002A30000-memory.dmp

                                                                            Filesize

                                                                            960KB

                                                                            Download

                                                                          • memory/5116-22-0x0000000000400000-0x00000000008FE000-memory.dmp

                                                                            Filesize

                                                                            5.0MB

                                                                            Download

                                                                          • memory/5116-0-0x0000000000400000-0x00000000008FE000-memory.dmp

                                                                            Filesize

                                                                            5.0MB

                                                                            Download

                                                                          • memory/5116-1-0x0000000002940000-0x0000000002A30000-memory.dmp

                                                                            Filesize

                                                                            960KB

                                                                            Download

                                                                          We care about your privacy.

                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.